Russian-Georgian Cyber War Continues?!

War attacks between Georgia and Russia continue not only in real life but in the cyber world as well. This time, Spam Data Mine of the University of Alabama at Birmingham (UAB) reports about a new flow of spam attacks the look of which is similar to the recent CNN and MSNBC spam campaigns. In short, this new attack in the so called "Russian-Georgian Cyber War" aims to mock Georgia's president and infect users' computers by attracting their attention claiming that Mikheil Saakashvili is homosexual.

The first rather poorly worded spam messages were recorded by the Spam Data Mine of the UAB early on Friday morning. More than 500 such messages were received in the 90-minute period. Gary Warner, a director of computer research and forensics at the university, notes that by volume the MSNBC and CNN spams are about three times as prominent as the new BBC/Georgia spam. However, it should be added that the new Georgian spams are unrelated to the recent CNN and MSNBC spams.

Three noted subject lines of these emails are the following BBC NEWS, Weekly BBC NEWS and Your Subscription. Some of the most popular headlines of the messages include: Mikheil Saakashvili gay scandal! New of this week!; Saakashvili have a funny woman organ (pu..sy)! see it!; Funny Saakashvili gay video...See now! Sensation!; Sensation! President of Georgia... GAY! See now!; Last news! Saakashvili (president of Georgia) the gay!; President of Georgia - intim (GAY) video! see now!.

Each spam message contains a link to the story about Georgia's president and an image from the BBC. Warner warns users that clicking on the headline or the image will take them to a malicious Web server that then will, most probably, infect users' computers. The terrifying fact here is that at the moment only 4 out of 36 anti-virus products (namely eSafe, Ikarus, Norman and Webwashwer-Gateway) marked the "name.avi.exe" as suspicious.

So far these emails have been received from more than 40 IP addresses. None of them have been associated with spam attacks earlier. Warner noted that "Several of the computers being used to send the new spam campaign are in Russia, including at least one computer owned by the Federal Agency of Education." Although the spammers seem to be setting up a botnet, the ultimate use of this network remains unclear. Warner speculated that it could be used to launch further cyber-attacks against Georgian government computers.

Resources:

New BBC Spam Mocks Georgia's President and Spreads New Virus
Spam Data Mine Uncovers Russian-Georgian Escalation
Anti-Georgia Spammers Building New Botnet