[Mimedefang] Heads up - stock pump'n'dump SPAM as ZIP (actually RAR) attachments

[David F. Skoll]

Paul Murphy wrote:

> On inspection, the ZIP file is actually a RAR archive, which
> contains a single text file with varying name (see list below).  The
> contents are all pushing stock from SZSN, which has been a favourite
> of the plain text and PDF spam over the last month or so, with
> random text at the end.

> Anyone else seeing a sudden increase in this stuff?

Yes; we are.  We hold ZIP files, so none is getting through, but I
guess we'll need a new rule to block them. :-(

Regards,

David.