Become a fan of Slashdot on Facebook


Forgot your password?
Slashdot Deals: Cyber Monday Sale Extended! Courses ranging from coding to project management - all eLearning deals 20% off with coupon code "CYBERMONDAY20". ×

Submission + - newGOZ Spams Again - GameOver Zeus spam observed in the wild (

GarWarner writes: Brendan Griffin over at Malcovery has posted a new story documenting two spam campaigns seen in the wild today that use the newGOZ Command & Control infrastructure. The first spam used the subject line "Subject: Fw: Credit Applicaiton" (sic) while the second campaign of the day used the subject line "Subject: Haun Welding Invoice". (Haun Welding is a real company in Syracuse, NY, obviously not associated with the malware.)

Four Command & Control servers, all generated by the Domain Generation Algorithm previously discussed, were observed in the wild today .. all resolving to the same IP addresses.


(Square brackets added to prevent malware detectors from freaking out...)

If you have network traffic headed to any of these destinations, that would be a Very Bad Thing.

Question of the Day: The C&C's are certainly set up "Fast Flux Style" — they use a 300 second Time To Live, but have held the same IP hosts all day long. That's a change from the behavior observed July 10th by this botnet (shared here as ( ). Theories on why are welcome . . .

This discussion was created for logged-in users only, but now has been archived. No new comments can be posted.

newGOZ Spams Again - GameOver Zeus spam observed in the wild

Comments Filter:

Those who claim the dead never return to life haven't ever been around here at quitting time.