Posté par: igor51 le mars 17, 2013, 20:05:04
On March 4th we spotted a large number of unusual emails being blocked by our Linux Mail Security product. The emails all contained the same PDF attachment (MD5: 97b720519aefa00da58026f03d818251) but were being sent from many different source addresses.
The emails were written in German and most were sent from German IP addresses. Below is a map showing the distribution of addresses:
The computer names referenced in the mail headers were often of the form Andreas-PC or Kerstin-Laptop (the names have been changed to protect the innocent) suggesting that they had been sent from German home computers.
Source: Reminder: be careful opening invoices on the 21st March (http://www.securelist.com/en/blog/837/Reminder_be_careful_opening_invoices_on_the_21st_March)