ISP disconnection trojan exploits 'net addiction'

Samples intercepted by the security vendor carry the subject line 'Your internet access is going to get suspended' from the sender 'ICS Monitoring Team'.

The spam emails claim that the recipient has been conducting illegal activities online, which are said to be documented in a .zip file attached to the emails.

Unsuspecting users, who may be dependent on their connection or concerned over the recent spate of online piracy cases, that open the file risk infection from a malicious Trojan horse which will give hackers covert access to their PC.

“With a recent survey finding that nearly half of Britain’s web users suffer from net addiction, it was only a matter of time before spammers would deploy social engineering tactics to take advantage,” said Graham Cluley senior technology consultant at Sophos.

“Recent piracy cases will also worry web users, especially those who may be using unsecured Wi-Fi – they'll want to open the attachment to make sure that someone else hasn’t been using their connection to download copyrighted movies or music.

“Unfortunately by then it’s too late, and they could have handed access to their computer and files to the hackers,” he said.

According to Sophos, the spammers have been using two malicious attachments in these emails, detected as Troj/Meredrop-A and Troj/Agent-HQK.

Sophos recommends all computer users ensure their anti-virus protection is up to date, and run a consolidated solution at the email gateway to defend against viruses and spam.