Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?

Submission + - newGOZ Spams Again - GameOver Zeus spam observed in the wild (

GarWarner writes: Brendan Griffin over at Malcovery has posted a new story documenting two spam campaigns seen in the wild today that use the newGOZ Command & Control infrastructure. The first spam used the subject line "Subject: Fw: Credit Applicaiton" (sic) while the second campaign of the day used the subject line "Subject: Haun Welding Invoice". (Haun Welding is a real company in Syracuse, NY, obviously not associated with the malware.)

Four Command & Control servers, all generated by the Domain Generation Algorithm previously discussed, were observed in the wild today .. all resolving to the same IP addresses.


(Square brackets added to prevent malware detectors from freaking out...)

If you have network traffic headed to any of these destinations, that would be a Very Bad Thing.

Question of the Day: The C&C's are certainly set up "Fast Flux Style" — they use a 300 second Time To Live, but have held the same IP hosts all day long. That's a change from the behavior observed July 10th by this botnet (shared here as ( ). Theories on why are welcome . . .

This discussion was created for logged-in users only, but now has been archived. No new comments can be posted.

newGOZ Spams Again - GameOver Zeus spam observed in the wild

Comments Filter:

Live free or die.