Sober Resurfaces After More Than Three Years

The ugly worm known for three and a half years has reappeared. After first hitting the Internet in October 2003, the family of Sober worms spread widely infecting computers all through 2004 and further in 2005. Now there is detection of another variant of this worm by two security firms.

On Monday, April 30 2007, Hon Lau, senior security-response engineer with Symantec posted a note on a blog that he has identified as W32.Sober.AA@mm being sent to users the previous day i.e., Sunday. The spam mail is either in English or German. It has an attachment carrying malicious code and employs social engineering tactics to lure unwary users into clicking on it. Itnews published this on April 12, 2007.

In May 2005, when Sober virus re-emerged it accounted for almost 77% of the entire virus activity on the Net, according to Sophos. At that time Sophos had warned that the worm continued to spread even after large organizations had likely fixed the vulnerabilities whose exploitation helped the virus to propagate.

The sudden Sober variant in April this year comes in an e-mail message, which informs the user that since he/she has forgotten his password, there is a new one for him/her. It further says that the new password is a random group of alphabets and numbers. The password is attached in a Zip file.

The gang of Sober users has been manipulating malware over two years spreading its program deep & wide, Graham Cluley, senior technology consultant for Sophos said this in an interview that Itnews published on April 12, 2007. The spammers use their malware to download harmful code from Internet to take command over the PCs, distribute spam and so on. The Sober hackers in the past have been successfully spamming out malicious code, Cluley added.

Cluley and Lau both advise users to refrain from opening attachments from unrecognizable sources and also to update their anti-virus software.

Related article: Spyware Detection Programs Track Advertisers’ Cookies

» SPAMfighter News - 5/9/2007