Storm Worm
The Storm Worm (dubbed so by the Finnish company F-Secure) is a backdoor Trojan horse that affects computers using Microsoft operating systems, discovered in January of 2007. The worm is also known as:
Small.dam or Trojan-Downloader.Win32.Small.dam (F-Secure)
CME-711 (MITRE)
W32/Nuwar@MM and Downloader-BAI (specific variant) (McAfee)
Troj/Dorf and Mal/Dorf (Sophos)
Trojan.DL.Tibs.Gen!Pac13
Trojan.Downloader-647
Trojan.Peacomm (Symantec)
TROJ_SMALL.EDW (Trend Micro)
Win32/Nuwar (ESET)
Win32/Nuwar.N@MM!CME-711 (Windows Live OneCare)
W32/Zhelatin (F-Secure and Kaspersky)
Trojan.Peed, Trojan.Tibs (BitDefender)
Storm Worm began infecting thousands of (mostly private) computers in Europe and the United States, using an e-mail message with a subject line about a recent weather disaster, "230 dead as storm batters Europe". During the weekend there were six subsequent waves of the attack. As of January 22, 2007, the Storm Worm accounted for 8% of all malware infections globally.
There is evidence, according to PCWorld, that the Storm Worm was of Russian origin, possibly traceable to the Russian Business Network. According to Joe Stewart, director of malware research for SecureWorks, Storm remains amazingly resilient, in part because the Trojan horse it uses to infect systems changes its packing code every 10 minutes, and, once installed, the bot uses fast flux (a DNS technique used by botnets to hide phishing and malware delivery sites) to change the IP addresses for its command and control servers.
