Security firm MessageLabs, which discovered the attack, explained that the Trojan targets only a small number of email addresses - 17 in this case - rather than mass mailing itself to as many recipients as possible.

The infected emails were transmitted to a highly targeted list of recipients at only four domains, suggesting that the hackers were using the malware for industrial espionage.

The attack is designed to exploit a vulnerability in Microsoft Word caused by a buffer overflow when handling macro names. A Word document containing a long macro name overflows a buffer allowing the embedded Trojan to execute (see Microsoft Security Bulletin MS03-050).

Utilising text content potentially relevant to the target audience, the email encourages the recipients to open an attached Word document claiming to provide further information.

Read this full article at vnunet

Write Comment
Please keep the topic of messages relevant to the subject of the article. Personal verbal attacks will be deleted. Please don't use comments to plug your web site.. Such material will be removed.
Name:
Title:
Comment:
Code:*

Powered by AkoComment!