"Test Mesage" SPAM / Mass Mailing Virus

[smarties11]

Hi All,

 

Has anyone else been receiving lots of these messages today? The subject line is always 'Test mesage ######A'. The hashes and A are random numbers followed by a random letter. Message is spelt incorrectly.

 

Looking at exchange tracking logs, the majority of recipients are [email protected] - with a handful of correctly named recipients. The from address is always random.

 

The body of the e-mail appears to be random snippets of text from Wikipedia articles. I've googled sentences and they all come back to Wikipedia.

 

The behaviour is very consistent with a mass mailing worm. They are definitely originating from outside our LAN as I can see that in the tracking logs.

 

I've spoken to our broadband/filtering provider (Mouchel) who are looking blocking these on their SPAM filters but I wondered if anyone else was receiving these? We've had 250 at the last count!

 

Google only retrieves a couple of relevant hits (both also from today) Google

 

New virus perhaps?

[network41]

Yes had about a couple of hundred today , spam filter has stopped them thankfully. Just annoying really.

[unixman_again]

We've had a few today; I've had 2, as have some staff, but others have missed out. I assume those whose email address is published on our website have had them.

[smarties11]

We've had a few today; I've had 2, as have some staff, but others have missed out. I assume those whose email address is published on our website have had them.

 

We don't publish staff e-mail addresses on our website (bar one or two) and many are also addressed to [real] pupils. This is what I found a bit bizarre! What was also very strange is that my e-mail address at work is my first name - but I go by a shortened version of it. The shortened version of it doesn't exist as an e-mail address here [and therefore can never have been scraped] yet wherever these e-mails originate from has tried my [email protected]?! Really weird......

[Sylv3r]

We've had a number of 'invoices' sent to us over the last few days.

 

Containing a .doc attachment with what I guess a macro.

[bossman]

We have been experiencing a few "Invoice macros" also some from a company down in Grimsby which I contacted tonight and they have admitted they have become a spam relay and their IT team are on it.

 

I have tightened up our spam filters and they seem to be working pretty well and as stated only a couple of these have come through over the past few day's, I do know our LA's e-mail service has been hit badly and they are still working on their services to counteract the attacks.

 

End users have to be constantly reminded on how to deal with bad mail and change their passwords regularly and make them more complex.

[elsiegee40]

We have had loads today, but we we have gmail (apps for education) and they've all gone to spam. Likewise the invoice ones have been filling upthe spam box over the last week or so.

[timbo343]

We have had loads blocked from humber merchants with the subject industrail invoice http://myonlinesecurity.co.uk/humber-merchants-group-industrial-invoices-word-doc-malware/. This site proves very useful if im not sure but 9.5 out of 10 im right.

We had a teacher who complained thatvthey were getting SPAM. I check the email logs and notice today there were 3 bits of junk, 2 of which were filtered so i asked how many buts of SPAM have they received today? The answer i got was 1.

 

At this point im thinking about sending the generic email out, 9.9 times our email filtering software keeps the nasties put however there is the odd 0.1 time when things slip through the net.

[synaesthesia]

Yeah we had one today as well. Rather random.

[tech_guy]

Yes, I have been getting the invoices as well and it looks like a healthcare company down in London has had their mail server compromised. The interesting thing for me is that they are all emails being sent to a domain I have registered/hosted with Fasthosts and the email addresses used are all 'throwaway' ones I have used over the years. I wonder if this goes back to the Fasthosts data breach?

[BassTech]

We had a few today too:

 

Subject: Test mesage 895875B

 

hi there

 

Clearly that agreement was with the company. Later, when Chad's locker is stuck, Oliver refuses to help him open it.

Meanwhile, Lei Ke Si returns. Ettinsmoor is the long, lonely land north of the River Shribble.

[Arreks]

We had a few today too:

 

Maybe it's a riddle!

[pybe]

I have seen ridiculous amounts of these across several domains I look after, we use barracuda cloud spam service and 95% seem to be blocked but the ones getting through are still enough to cause concern. I have added a couple of regex filters on subject which seems to be catching the rest (until the subject changes)

 

In case it helps any one these are the simple regex i'm blocking against subject.

 

Test \d\d\d\d\d\d.*

Test mesage \d\d\d\d\d\d.*

 

I'm quite concerned though that this is just as the test to validate address before something nastier as there is an incredible volume yet no apparent payload.

[Mark182]

I got this last night!

 

[email protected]

Neville Boone

Test mesage 320017F

 

"hi there

 

Shooting started 27 October 2009. Alarmed, Santana claims that she was only sleeping with Brittany because Puck was not available.

The first mayor of the town was Nikolaus Hermann, and Lauban received its own seal. Extraversion, and both tend to move toward others to the same degree, but they may be doing it for quite different reasons.

"

[Garacesh]

Saw a thread about this on Spiceworks yesterday. It appears the phrases are pulled from Wikipedia/Twitter/other such public sites. It's presumably testing a botnet for even less scrupulous emails to be sent out at a later date. Apparently the vast majority of emails don't contain attachments (yet)

 

None reported here, but maybe our spam filter is catching them all. Turns out we've had a few.

Edited November 14, 2014 by Garacesh

[pooley]

Receiving lots but with no attachments.

 

Have blocked "Test mesage" on my domain, will await the next reincarnation.

[Arreks]

It's presumably testing a botnet for even less scrupulous emails to be sent out at a later date. Apparently the vast majority of emails don't contain attachments (yet)

 

That's what I would put my money on.

 

People might want to send out a reminder on email security..

[CadlaM]

Am getting recent Test Mesage and invoice Spams too. Think my Sophos Pure Message is not set up ideally to block them. Does anyone have any exported sample Blocked Phrase files for Strings and regular expressions? Please

[pybe]

These two are the current regex i'm blocking on subject only:

 

Test \d\d\d\d\d\d.*

Test mesage \d\d\d\d\d\d.*

[CadlaM]

pybe

 

A few minutes after I entered your regex entries. I got a Sophos PM quarantined message. From Edugeek! because it quoted original words. Wow, it worked. I must learn more about the regex.

 

Cheers

[Garacesh]

pybe

 

A few minutes after I entered your regex entries. I got a Sophos PM quarantined message. From Edugeek! because it quoted original words. Wow, it worked. I must learn more about the regex.

 

Cheers

 

Ha. You might want to only compare against the subject, not the message body

[pybe]

Yep definitely Subject only

 

This is a good site to play, test, and learn regex http://www.regexr.com/

Edited November 14, 2014 by pybe

[markcuk]

Had a few today and also yesterday, no attachments just random txt pulled from the web!