[Mimedefang] Heads up - stock pump'n'dump SPAM as ZIP (actually RAR) attachments

[Paul Murphy]

Hi all,
 
I've seen 30+ messages overnight which my filter has rejected as being a corrupt ZIP file, since it tries to list the contents of all ZIP archives to see whether any banned file extensions are included.
 
On inspection, the ZIP file is actually a RAR archive, which contains a single text file with varying name (see list below).  The contents are all pushing stock from SZSN, which has been a favourite of the plain text and PDF spam over the last month or so, with random text at the end.

Anyone else seeing a sudden increase in this stuff?

Paul.


-- 

-------------------------------------------------------
Paul Murphy
Head of I.T.
Argenta Discovery
Tel. 01279 645 554
Fax. 01279 645 646



_______________________________________________________________________
Argenta Discovery Ltd, 8-9 Spire Green Centre, Harlow, Essex, CM19 5TR
Registered in England No. 3671653
_______________________________________________________________________