Stratfor clients now targeted with malware

The customers of Stratfor, a US-based research group that provides geopolitical analysis to government organizations and major corporations, are being targeted once again with malicious spam emails.

Following the December breach of the company’s servers by Anonymous and the stealing of names, home addresses, credit card details and passwords of its clients, those very clients began to receive spear-phishing emails purportedly being sent by Stratfor CEO George Friedman, asking them to fill out an attached document with personal information.

This time around, the emails appear to be sent by a Stratfor admin, who first warns clients not to open emails and attachments from “doubtful senders”, and then urges them to download an (attached) security software to check their systems for a nonexistent piece of malware:

“The link displayed in the emails appears legitimate at first glance, but looking closely at the target address, you notice that it doesn’t originate from the address in the email text,” says Microsoft. “Stratfor is based in Texas, United States however the download URL is located somewhere in Turkey. A sample of another PDF file contained a download link for yet another compromised site, this time in Poland.”

Less careful users will, unfortunately, end up with a malicious PDF file or a variant of the Zbot information stealer Trojan on their systems.