Never Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.
Bagle Trickier Than First Thought
Security firms offer more detailed accounts of a massive spam-based attack of Bagle-like Trojan horses.
March 2, 2005
2 Min Read
After a day's analysis, security firms offered more details about Tuesday's massive spam-based attack of Bagle-like Trojan horses.
The assault was begun by, at most, two to four worms, not more than a dozen different Trojan horses as some suspected, security firm F-Secure said Wednesday.
"There are at least two new variants of the Bagle worm going around," said F-Secure in an online advisory. "One feature of these new variants is to use infected computers to seed out e-mails, with the downloader program as an attachment. So in addition of sending out e-mails with the virus, they send out e-mails with a downloader which won't spread further. Lots of them."
The "downloader" F-Secure mentioned is the Trojan horse (actually, horses, since there were at least four different versions of that.)
In other words, the new Bagles -- Symantec IDed four, and named them Bagle.bg, Bagle.bh, Bagle.bi, and Bagle.bj -- were seeded first. Once they infected a system, the worms then used their own SMTP mailing engine to spam out copies of the non-replicating Trojans. If those were successful in infecting a PC, they in turn tried to connect with a remote site -- which was shut down mid-day Tuesday -- to pull e-mail addresses to spam more computers.
That, said F-Secure, was another way that this latest attack differed from previous Bagle campaigns.
"These new Bagle variants are using a client/server architecture to spread," the company said in its advisory. "Normally Bagle variants search the local hard drive to find e-mail addresses to send itself to. [But] these new variants connect to a back-end server [that] then returns 50 unique email addresses that it generates using directory harvest techniques."
No new Bagle variants had been spotted as of mid-morning Wednesday (PST).
You May Also Like
G2 Grid® Report for Enterprise Monitoring | Winter 2024
University of Minnesota Uses Entuity to Strategically Manage and Upgrade Complex Network Environment
Five Advantages of Fortinet Data Center Firewalls
Integrations to automate your framework compliance: ISO 27001, SOC 2, and NIST CSF
Key Lessons for Enterprise Service Management