H1N1 No Longer Just the Swine Flu; Now It Steals Your Data Too

It’s not just the swine flu strain anymore. Now H1N1 is a strain of malware downloader that is evolving to steal data. While it used to be employed to drop in malware such as Vawtrack Banking Trojan and Pony Infostealer, it now has its own capabilities and can install files, including other malware, on systems and bypass anti-virus software to do it.

There’s more! It can now spread itself onto USB drives that may be connected to a computer as well as to other computers on the same network. But wait! There’s even more. Once it spreads, it can now gather information from the compromised systems, encrypt the data, and send it to a central command and control server. Desired information is email login data from MS Outlook, Firefox profile data, and Internet Explorer Intelliform data, which is information stored in the browser.

Current targets of this attack are financial institutions, military organizations, communications organizations, government, and energy sectors.

The malware is being spread in phishing email messages that have an attached DOC file. That file requires macros to be enabled in order to open it. If they are, a script runs that installs H1N1 and the damage is done. The subject changes to keep potential victims on their toes.

Unless you created the macros, you know who did, or absolutely need macros enabled on your system, shut them off by default. In newer versions of Microsoft Office, they are installed deactivated by default, but in older versions they were not. If you are still using an older version of the suite or any individual component, go into your settings and deactivate them.

Remember never to open links or attachments from email messages unless you are expecting them. It’s easy to spoof a sender’s email address these days and make it look like you know the sender. Just because the name is familiar doesn’t mean that person actually sent it. Follow up using the phone, sending a text, walking to his or her desk, or starting a brand new message (as opposed to hitting reply) back to confirm.

Researchers at Cisco discovered that there were 177 registered domains by H1N1’s authors being used to send spam to spread this flu. The email address associated to the domains is from Poland.