NetTraveler using Prism as bait for malware

The group behind NetTraveler are using the Prism controversy to lure victims into reading a booby-trapped email. The recent email was discovered by blogger Brandon Dixon. The mail, which tells the tale of the disclosure of PRISM and other NSA programs, offers a 2.5MB file – "Monitored List1.doc" – and implies that this contains a list of those monitored by the NSA. The email of course contains malware and exploits an older vulnerability CVE-2012-0158 to infect the computer.

Dixon indicates that the mail was sent by a Yahoo account that is associated with the Regional Tibet Youth Congress. His cursory analysis of the malware connects the phishing mail with the people behind the NetTraveler campaignPDF. Kaspersky exposed the group earlier this month as a targeted spyware and phishing ring. With at least 350 victims in 40 countries, the ring targeted individuals from private and public institutions, government agencies, research organizations and the defense industry as well as Tibetan activists. This new email is spoofed to appear to be sent by Jill Kelley, who found herself at the center of the Petraeus scandal.


The email tries to drop malware on the victim