It seems like these days every other news breaking story is paralleled with a similar Blackhat SEO fueled Rogueware campaign. Today, Luis Corrons and I were talking about Microsoft’s recently announced Project Natal when his Google search for a video of the technology in action turned out to place a malicious link in the very top of the search results.


Connection: (Google to Rogue)

 

**UPDATE** 6/04/09 – 

16,000 new malicious links have appeared in Google over the last 24 hours targeting the phrase "TV Online". The malicious site appears to be a video viewing website.  It will prompt to you to downoad and install a codec.exe file, which of course is a malicious file.

 

Knowing that this link wouldn’t be the only one, we started researching the domains and keywords being targeted and here is what we found:

Keywords:
16,000 links targeting "TV Online"
16,000 links targeting “YouTube”
10,500 links targeting "France" (Airline Crash)
  8,930 links targeting "Microsoft" (Project Natal)
  3,380 links targeting "E3"
  2,900 links targeting "Eminem" (MTV Awards/Bruno Incident)
  2,850 links targeting “Sony”

The sites are all hosted via Lycos Tripod, which is a free web host. This allows the cyber criminals to create thousands of free sites to take advantage of the Blackhat SEO and then simply redirect the free sites to just a handful of their own servers.

Blackhat SEO is definitely one of the most prevalent threat distribution methods today. We expect to see several more examples of this type of attack throughout the year, so be especially careful when searching for news breaking stories.

All of the links associated in this attack have already been blocked for Panda users.