Botnet Sending Fake UPS Invoices

“For the unwary or uninitiated, at first glance, the message appears to come from UPS,” warned Phil Hay, lead threat analyst for Marshal TRACE Team. “The subject line of the message provides a seemingly official tracking number and the message itself seems sincere. It suggests that UPS could not deliver a package because the delivery address you supplied was incorrect. The message asks you to print out an invoice and go to the UPS office to collect the package. However, the purpose of the message is malicious. If the attachment is opened, a program will be installed that downloads more malicious components from the web.”

The message includes a ZIP file attachment called ‘ups_invoice.zip’. According to Marshal, the Pushdo botnet often uses ZIP archive files as attachments to hide malicious executable files from automatic email filters. The file inside the ZIP is called ‘ups_invoice.exe’ but displays a Microsoft Word icon in an attempt to make it appear like a harmless Word document.

“The message itself is full of mistakes and poor grammar, which gives it away as illegitimate and malicious,” said Hay. “The subject line misspells the word ‘packet’ and the message provides no contact address for the supposed collection of the package. These kinds of errors should trigger alarm bells with security conscious recipients, even if they have recently ordered a package to be shipped by UPS.”