Category Archives: Security Response News

In recent days, the European Union (EU) financial crisis has taken a dramatic turn. Cyprus, one of the EU’s smallest member states by population, announced plans to impose a one-off levy of up to 10 percent on ordinary bank deposits. Banks across the island state have been closed while the unprecedented measures are debated in the country’s parliament. Meanwhile, anxious bank account holders—ordinary people, not bond holders or investors in Cypriot banks—await news of what will happen to their savings.

The notorious Blackhole Exploit Kit, previously featured in several posts on this blog, has started exploiting the public concern about this situation by sending out emails claiming to be news stories related to the unfolding situation.

Figure 1. Blackhole Exploit Kit malicious email

The message claims to be from the British Broadcasting Corporation (BBC) news site’s article recommendation service. The sending address has been spoofed, as have certain BBC recommendation message headers.

These messages link to a landing page with the title “Cyprus Crysys [sic] – BBC” that pretends to actually be from the British Broadcasting Corporation. This page also states: “You will be redirected to news”.

Figure 2. Blackhole Exploit Kit’s fake BBC news landing page

The page actually redirects to a familiar Blackhole Exploit Kit page which attempts several exploits, targeting vulnerabilities in Adobe Flash Player, Adobe Acrobat Reader, and Java. After several seconds, a timer function is run which then redirects the user to the real BBC website.

Figure 3. Blackhole Exploit Kit’s obfuscated JavaScript targets vulnerabilities

As mentioned, Cyprus is one of the smallest member state in the EU, but the impact of events there have broader implications. Many people in Greece moved money to Cyprus during Greek’s recent financial and political instability, believing their money would be safer there. Cyprus is also a popular offshore center for Russian business.

The parliament in Cyprus has since rejected the proposed tax, and a prominent North American bank is now being used as social-engineering content for new Blackhole Exploit Kit emails—demonstrating how quickly malware authors can respond to current affairs.

Symantec.cloud has identified more than 50 compromised websites redirecting to this latest Blackhole Exploit Kit social-engineering attack.