The Storm worm, also known as Dref or Dorf, was 2007’s most disruptive threat, with around 50,000 variants seen over the course of 2007. The criminals behind the Storm attack used topical news stories, electronic greeting cards, videos and fear tactics to lure people into opening their widely spammed-out emails and click on their malicious links.

Early January 2007: Starting as Happy New Year malware5 which spread malicious greetings via email attachments, the hackers changed their tack in January using news-related events to encourage recipients to click on what claimed to be video content. One of these disguises, which had subject lines such as “230 dead as storm batters Europe”6, gave the worm its popular name of Storm.

Late January 2007: The Storm worm turned to love in a major new attack as St Valentine’s Day approached7, and in the run-up to US Independence Day on 4th of July8 the malware gang aggressively took advantage of the celebrations with another malicious ecard campaign. On this occasion, the email contained a web link to compromised zombie computers hosting a Trojan horse.

August 2007: Storm used a wave of malicious emails which posed as links to YouTube videos9, and then posed as links to music videos of popstars like Beyoncé, Rihanna and The Eagles. If infected, hackers could use victims’ computers to steal personal information, spam out malware and junk email, or launch distributed denial-of-service attacks against innocent parties.

September 2007: The Storm worm took advantage of the NFL Kickoff weekend10 and spammed out an email campaign with links to a hacked website, which would drop malicious code onto insufficiently protected computers.

November 2007: The hackers tried to scare email users into believing their telephone conversations were being recorded, but the ruse was designed to get people to buy bogus security software. In reality, however, the attached MP3 file was a malicious executable program that installed further malware onto the victim’s computer which it downloaded from a dangerous website. Amongst these was a piece of scareware which displayed a fake Windows Security Center alert and tried to convince the victim to purchase bogus security software.

December 2007: The criminal hackers behind the Storm malware showed no signs of letting up and continued their offensive attacks, sending emails claiming to point to websites offering pictures of a stripping “Mrs Clause” and Happy New Year messages.

Source: Sophos Threat Report 2008.