Fake UPS invoices deliver Pushdo botnet package

happygeek 0 270 Views

Security researchers within the Marshal TRACE Team have warned that malicious spammers are using fake United Parcel Service invoices in order to deliver a malware payload.

Always looking for a new and convincing hook to snare the unsuspecting user into downloading malicious components from the web, this new attack utilises the Pushdo botnet to distribute fake UPS invoices requiring printing in order to claim an 'undelivered' package from the local office.

Of course, the attached executable file called 'ups_invoice.zip' which has an MS Word icon in an attempt to add authenticity is not an invoice at all but rather installs some malware which "seeks to download more malicious components from the web" according to Marshal.

“For the unwary or uninitiated, at first glance, the message appears to come from UPS,” warned Phil Hay, Lead Threat Analyst for Marshal TRACE Team. “The subject line of the message provides a seemingly official tracking number and the message itself seems sincere." However, upon a little closer inspection you might notice that the message is full of spelling mistakes and grammatical errors that would be unlikely to escape from any official UPS outlet.

“The subject line misspells the word packet" Hay reveals "and the message provides no contact address for the supposed collection of the package."

All of which should set alarm bells ringing. Which is just as well considering that the Pushdo botnet is currently estimated to include some 125,000 compromised computers, and is responsible for the distribution of 16 billion spam messages per day according to Marshal’s statistics. Indeed, Pushdo is currently the fourth largest botnet in terms of spam volume...

Dani AI

Generated

As reported, shipping‑notice lures are a classic social‑engineering vector and remain effective because they create urgency and a plausible reason to open attachments. Grammar mistakes help spot crude scams, but modern messages can be professionally written. The guidance below provides a short, practical triage and prevention checklist that complements the original report.

Immediate triage and safe analysis:

  • Do not open or execute attachments, and keep mail preview panes disabled.
  • Capture the original message (EML/MBOX) and full headers for analysis before any changes.
  • Inspect headers for mismatched envelope vs. display From, and for SPF/DKIM/DMARC results.
  • Analyze attachments offline or in an isolated sandbox. Compute a hash and list archive contents without executing files:
# PowerShell (Windows)
Get-FileHash -Path "C:\path\message.zip" -Algorithm SHA256

# CLI (Windows)
certutil -hashfile "C:\path\message.zip" SHA256

# List zip contents without extracting (7-Zip)
7z l "C:\path\message.zip"

Containment and remediation:

  • Immediately isolate a suspected host from the network to prevent further downloads or lateral movement.
  • Preserve memory and disk images if forensic investigation is needed; collect process, scheduled tasks, and startup entries (Autoruns).
  • Use updated AV/EDR to scan, and monitor for unusual outbound connections (netstat/SIEM). If persistence mechanisms are found or remediation fails, rebuild from a known‑good image.

Prevention and hardening:

  • Block risky attachment types at the gateway, detonate attachments in a sandbox, and enforce SPF/DKIM/DMARC.
  • Keep systems patched, limit user privileges, maintain offline backups, and run phishing awareness exercises.
  • Treat any unexpected shipping notice with skepticism: attackers increasingly impersonate trusted brands and can craft messages that look legitimate.
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview