Chinese Whaling, Where the CEO is the Whale

Whaling, Where the CEO is the Whale.

Arguh ther be Whalers huntin fer the CEO's hide and gut$.

They be using a tax court Email fer the bait and
Spear him hard n fast, if he takes the bait.

Chuming with:
Notice of Deficiency
Fake VeriSign certificates.

Spears be:
certificate for a root CA (certificate authority)

The active.php page attempts to install an ActiveX control. The ActiveX control comes packaged as a Microsoft CAB file. The CAB file is signed with a certificate fraudulently using the name Adobe Systems Incorporated, issued by the CA represented by the bogus VeriSign certificate.

Rhifrem Trojan, also known as Fireming,

klog: keylogger data



Who be these Whaling pirates?
221.195.42.67, a virtual hosting server in IP address space administered by China Network Communications Group in Beijing. DNS for the domain was provided by "4everdns" nameservers in Beijing and Shanghai.

If you be lampooned be contacting yer legal Maties not GreenPeace.

We be Shanghai-ing info from here.

Captian Gerald
With eye patch in place.

Rumint China
.

Related articles

• Symantec confirms ActiveX bugs in its own consumer software [via Zemanta]
• Infamous RBN quits China [via Zemanta]