Tens of thousands of users woke up today to find German hate propaganda spam in their inbox. Piggybacking on the recent increase in activity of the Sober worm, the German hate spam is thought to take advantage of the trail left by the Sober worm, but is not a worm itself. Instead it uses PCs infected with the Sober worm to relay its hateful message, both in German and English.
Dubbed Sober-Q, experts say that the spam was sent over the weekend by someone with an axe to grind – or a cause to champion, depending on how you see it – but probably not for any financial gain. In other words, the spammer turned the spamming infrastucture created by the Sober worm into his or her own personal soapbox, rather than sending spam advertising a product.
Said Vincent Gullotto, vice president of McAfee’s virus research lab, “It is a one-time political message.”
Elaborated Scott Chasin, CTO of MX Logic, “Spam has been traditionally regarded as annoying messages that promote Viagra, porn and low cost mortgages. But for the past year we have seen a trend in which worm authors are using spam not to hawk goods, but as a tool for political propaganda.”
And hateful propaganda it is. The seemingly Neo-nazi affiliated spam decries the Dresden bombing, and the admittance of Turkey into the United Nations, and has such inciteful subject lines as “Multi-Kulturell = Multi-Kriminell” (multi-cultural = multi-criminal), “The Whore Lived Like a German”, and “Dresden 1945”.
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
I’m getting particularly annoyed by this one because, like all Sober worms before it, it spoofs the sender address. Thus, I’ve been getting bounces from a variety of addresses for this German stuff that I never sent out (and that I totally disagree with, but that’s another point entirely)…
I also got about 5 or 6 emails with German sexual ads. I used a free online translator to see what the email said. There was no attachment with the email. Some of the emails spoofed well known companies, such as Williams-Sonoma, and a couple of bank/insurance websites. I sent a copy of the email with the full headers to the spoofed companies, and Williams-Sonoma replied to me and said they had received over 900 such emails in one hour and were working on the problem. I don’t get those kind of German language emails anymore so it looks like it’s been fixed by Symantec and other companies.
I am really upset about this. Stupid nazis are spamming me? LAME. My inbox has recieved zero spam before this stuff, and now I get a lot. 14 today, and I’m sure there will be more as the virus spreads. Thankfully Kaspersky Labs has updated, and hopefully Synmantec and all the others will follow by the end of the night. I think everyone interested in this virus should check out this thread on DSL Reports, where there is some more good info on how people are being effected by this. http://www.dslreports.com/shownews/63586