It looks like the folks who were spoofing government agencies and targeting C-level executives are at it again; this time spoofing the U.S. District Court.
If you recall, starting around the end of May, 2007 we started to see a month and a half long wave of messages that were being targeted to C-level executives that carried a keylogger payload and used a lure of fake complaints against that executive's company in an attempt to get them to infect themselves. This tactic was, unfortunately, very successful which is why it hung around for as long as it did. These spoofs used an effective social engineering tactic that included both the name of the person receiving the scam as well as the name of their company. This fooled many into believing that the message was indeed legitimate because it didn't carry the earmark of most of your scams that are generically blasted en masse.
This new scam follows this same basic social engineering tactic except it takes it one step further in that it also includes the phone number of the company being targeted. This is just another way that the scammers are attempting to establish legitimacy with their intended target since it doesn't look like your everyday, run of the mill type of spam.
By targeting C-level executives, the technique used in this type of attack is called "whaling." It is called whaling because they are trying to get the largest fish that they can on the hook; people who are generally more affluent and stand more to lose, both personally and professionally.
Below is an example of one of these messages (Some personal information has been redacted):
AO 88(Rev.11/94) Subpoena in a Civil Case
________________________________
Issued by the
UNITED STATES DISTRICT COURT
________________________________
Issued to: XXXXXXXXXXXXXXXXXXX
COMPANY NAME HERE
COMPANY PHONE NUMBER HERE
SUBPOENA IN A CIVIL CASE
Case number: 91-201-NKE
United States District Court
YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States
District Court at the place, date, and time specifiied below.
________________________________
Place: United States Courthouse
880 Front Street
San Diego, California 92101
Room: Grand Jury Room
room 5217
Date and Time: May 7,2008
9:00 a.m. PST
Issuing officers name and address: O'Mevely & Meyers LLP; 400 South Hope Street, Los
Angeles, CA 90071
________________________________
Please download the entire document on this matter(follow this link) and print it for your
record. <hxxp://cacd-uscourts.com/ViewCase.php?case=91-201-NKE>
This subpoena shall remain in effect until you are granted leave to depart by the court or
by an officer on behalf of the court.
Any organisation not a party to this suit thas is subponaed for the taking of a deposition
shall designate one or more offcers, directors, or managing agents, or other persons
to testify on its behalf, and may set forth, for each person designated, the matters on
wich the person will testify. Federal Rules of Civil Procedures,20(b)(6).
Failure to appear at the time and place indicated may result in a contempt of court
citation. Bring this subpoena with you to the courtroom and oresent it to the bailiff. Direct
any questions to the person requesting you to appear: City Prosecutor.
You'll notice a few spelling errors which is your typical dead giveaway that something isn't quite right here (of course, the US District Court trying to communicate with you via email, which it never does, should have been the first one). They also went to the trouble of registering a new domain, cacd-uscourts.com.
Here is where it gets funny:
-- cacd-uscourts.com is the domain used. If this were really a government domain, would it have a .gov TLD?
-- This domain was registered two days ago to someone named Michael Rice who lives in the U.K.
-- Registration for the domain was done by a company named WEB4AFRICA
It's been a while since we have seen this type of scam outside of the IRS spoofs that we have been seeing in accordance with tax season so I am sure it will get its share of victims. No solid information yet on whether these new phish are being sent to the same C-level execs who were targets of last year's scams. More information to come as it becomes available.
**** UPDATE 1 (4/15/2008 12:00pm MDT): We are still seeing these emails hitting our system at a rate of about 30 per hour. Obviously very low overall volume, but that speaks to the precision of the targeting being used. The highest hour that we have seen so far today was the 10am hour where we saw 50, and we basically saw none between midnight and 7am. It appears that the cacd-uscourts.com domain that was hosting the malware yesterday has had its registration suspended by WEB4AFRICA. The web site is no longer accessible.
