{"id":10169,"date":"2013-03-21T00:00:05","date_gmt":"2013-03-21T07:00:05","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=10169"},"modified":"2018-10-05T12:23:30","modified_gmt":"2018-10-05T18:23:30","slug":"fake-cnn-breaking-news-alerts-themed-emails-lead-to-black-hole-exploit-kit","status":"publish","type":"post","link":"https://www.webroot.com/blog/2013\/03\/21\/fake-cnn-breaking-news-alerts-themed-emails-lead-to-black-hole-exploit-kit\/","title":{"rendered":"Fake ‘CNN Breaking News Alerts’ themed emails lead to Black Hole Exploit Kit"},"content":{"rendered":"

By Dancho\u00a0Danchev<\/strong><\/p>\n

Cybercriminals are currently mass mailing tens of thousands malicious ‘CNN Breaking News’ themed emails, in an attempt to trick users into clicking on the exploit-serving and malware-dropping links found within. Once users click on any of the links found in the bogus emails, they’re automatically exposed to the client-side exploits served by the Black Hole Exploit Kit<\/strong><\/a>.<\/p>\n

More details:<\/p>\n

<\/p>\n

Sample screenshot of the spamvertised email:<\/strong><\/p>\n

\"Fake_Email_Spam_CNN_Breaking_News_Alerts_Exploits_Malware_Social_Engineering_Black_Hole_Exploit_Kit\"<\/a><\/p>\n

Sample compromised URLs used in the campaign:<\/strong>
\nhxxp:\/\/320315.ru\/popeabuse.html<\/em>
\nhxxp:\/\/bigznakomstva.ru\/popeabuse.html<\/em>
\nhxxp:\/\/cescasworld.com\/popeabuse.html<\/em>
\nhxxp:\/\/c-s-x.ru\/popeabuse.html<\/em>
\nhxxp:\/\/create-serv.ru\/popeabuse.html<\/em>
\nhxxp:\/\/adobeart.ru\/popeabuse.html<\/em>
\nhxxp:\/\/cescasworld.com\/popeabuse.html<\/em>
\nhxxp:\/\/bloodygames.ru\/popeabuse.html<\/em>
\nhxxp:\/\/blackstyle.l2uc.ru\/popeabuse.html<\/em>
\nhxxp:\/\/bksxnations.com\/popeabuse.html<\/em>
\nhxxp:\/\/bidlo.lv\/popeabuse.html<\/em>
\nhxxp:\/\/create-serv.ru\/popeabuse.html<\/em>
\nhxxp:\/\/c-s-x.ru\/popeabuse.html<\/em>
\nhxxp:\/\/barrygloria.com\/popeabuse.html<\/em><\/p>\n

Sample client-side exploits serving URL:<\/strong> hxxp:\/\/webpageparking.net\/kill\/borrowing_feeding_gather-interesting.php<\/em><\/p>\n

Sample malicious payload dropping URL:<\/strong> hxxp:\/\/webpageparking.net\/kill\/borrowing_feeding_gather-interesting.php?<\/em>
\n\u00a0vxbzcc=1n:33:2v:1l:1h&tvwogqxl=3i&hkrjvnuc=1l:2v:1i:1i:2v:31:1n:1l:1o:1m&levo=1n:1d:1f:1d:1f:1d:1j:1k:1l<\/em><\/p>\n

Malicious domain name reconnaissance:<\/strong>
\nwebpageparking.net<\/strong> – 109.74.61.59; 24.111.157.113; 58.26.233.175; 155.239.247.247 – Email: mtviclub@yahoo.com
\nName Server: NS1.STREETCRY.NET<\/strong>
\nName Server: NS2.STREETCRY.NET<\/strong><\/p>\n

We’ve already profiled the same Name Servers in the following malicious campaigns:<\/p>\n