[nsp-sec] New nacha/ach Zeus run?

[Gabriel Iovino]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Greetings,

I am passing the following along for Beth Young and Kris Trower as their
email server was eating this message to NSP-SEC.

Thanks!

Gabe

- -- 
Gabriel Iovino
Principal Security Engineer, REN-ISAC
http://www.ren-isac.net
24x7 Watch Desk +1(317)278-6630

- -----Original Message-----
From: Young, Beth A.
Sent: Thursday, July 28, 2011 8:39 AM
To: nsp-security at puck.nether.net
Subject: New nacha/ach Zeus run?

In the course of investigating new domain registrations to add to our
blackhole DNS infrastructure, my co-worker came across what she
believes is prep for a new Zeus run.

Gary Warner from UAB did some blog posts the last time there was a
major Zeus spam run.

"ACH Transaction Rejected" payments lead to Zeus
http://garwarner.blogspot.com/2011/02/ach-transaction-rejected-payments-lead.html

More ACH Spam from NACHA
http://garwarner.blogspot.com/2011/03/more-ach-spam-from-nacha.html

It might also be related to this Zeus campaign but we don?t have
enough information right now to confirm this:
http://garwarner.blogspot.com/2011/07/government-related-zeus-spam-continues.html

The Domains are listed below.  Unfortunately, we don?t have a way to
do a bulk WHOIS on all the domains.  We do know that they were all
registered by Above.com.  The few we spot checked were all using this
information:

DNS Auth Server 1: ns1.above.com
DNS Auth Server 2: ns2.above.com

IPv4 address: 69.43.161.179
IPv4 address: 69.43.160.19



ach-gblog.info
ach-privacy-ashop.info
ach-privacy-hnow.info
ach-search-engine-net.info
ach-search-netblog.info
ach-search-nettoday.info
ach-websiters.info
ach-websitersstore.info
achat-mephedrone.com
achinfotechtools.info
achinfotoolsstore.info
achmeorgs.info
achnewsarticlestools.info
achprivacycprogramming.info
achregioncom.info
achregionwebsitecom.info
achsearchenginesnet.info
bestach-search-net.info
bestachinfotools.info
bestfedwire-u.info
bestnacha-c.info
bestnacha-i.info
bestnacha-q.info
bestnacha-site-a.info
bestnacha-site-i.info
bestnacha-solutions-h.info
bestnacha-solutions-o.info
bestnacha-solutions-t.info
bestq-transfer.info
domainnachaslidetools.info
electronicachregioncom.info
freenacha-e.info
freenacha-solutions-i.info
freenacha-solutions-k.info
freenacha-solutions-o.info
freenacha-solutions-q.info
freenacha-solutions-w.info
gachstore.info
irs-report-download-link-36754shop.info
irs-report-download-link-5743online.info
irs-report-download-link-6346blog.info
irs-reports-link.info
irs-reports-web-38176.info
irs-reports-web-47856today.info
irs-reports-web-4864online.info
irs-reports-web-file-89567today.info
irs-web-report-file-12357shop.info
irs-web-report-file-3463today.info
irs-web-report-file-5454today.info
irs-web-report-file-8566shop.info
irs-web-report-file-97865s.info
journal-nacha-domain-33252.info
mybestnacha-site-s.info
myirs-report-download-link-7222.info
myirs-reports-web-7805.info
myirs-web-report-file-45523.info
myirs-web-reports-download-6764.info
mynacha-o.info
mynacha-site-q.info
mynacha-solutions-h.info
mynacha-z.info
mynachaproduct.info
nacha-ashop.info
nacha-cnow.info
nacha-ctoday.info
nacha-domain-names-y.info
nacha-domains-generalnow.info
nacha-e-minor.info
nacha-eshop.info
nacha-estore.info
nacha-hosting-special.info
nacha-htoday.info
nacha-iblog.info
nacha-is.info
nacha-l-johnson.info
nacha-ltoday.info
nacha-otoday.info
nacha-ps.info
nacha-qnow.info
nacha-rblog.info
nacha-report-download-filesys.info
nacha-report-info-file-56234today.info
nacha-rstore.info
nacha-s.info
nacha-site-atoday.info
nacha-site-eblog.info
nacha-site-f.info
nacha-site-iblog.info
nacha-site-ishop.info
nacha-site-istore.info
nacha-site-oonline.info
nacha-site-pstore.info
nacha-site-qstore.info
nacha-sites-general.info
nacha-solutions-ablog.info
nacha-solutions-d.info
nacha-solutions-eblog.info
nacha-solutions-eshop.info
nacha-solutions-fblog.info
nacha-solutions-g.info
nacha-solutions-h.info
nacha-solutions-hnow.info
nacha-solutions-htoday.info
nacha-solutions-iblog.info
nacha-solutions-inow.info
nacha-solutions-is.info
nacha-solutions-jtoday.info
nacha-solutions-kblog.info
nacha-solutions-onow.info
nacha-solutions-oonline.info
nacha-solutions-provider-f.info
nacha-solutions-provider-r.info
nacha-solutions-sblog.info
nacha-solutions-stoday.info
nacha-solutions-tblog.info
nacha-solutions-wsite.info
nacha-solutions-yblog.info
nacha-sonline.info
nacha-t.info
nacha-ts.info
nacha-tstore.info
nacha-ustore.info
nacha-utoday.info
nacha-vstore.info
nacha-w-basketball.info
nacha-w-tennis.info
nacha-w.info
nacha-wblog.info
nacha-xnow.info
nacha-xs.info
nacha-y-camp.info
nacha-ytoday.info
nacha-zshop.info
nachaa.info
nachabusinessdomainblog.info
nachabusinessdomainstore.info
nachabusinessjournaldomain.info
nachadomaing.info
nachadomainregistrationi.info
nachadomainy.info
nachadomainyou.info
nachaexpressdomainsearchs.info
nachaexpresslanedomainsearch.info
nachaexpresstrainsdomainsearch.info
nachahelectric.info
nachajcrew.info
nachaksong.info
nachaoticket.info
nachap.info
nachapendingreportsblog.info
nachaplacenamesu.info
nachaplaceq.info
nachaqawards.info
nachasitea.info
nachasiteo.info
nachasitep.info
nachasitey.info
nachaslideexpressdomainsearch.info
nachasolutionsl.info
nachasolutionsprovidera.info
nachasolutionsq.info
nachasolutionsw.info
nachatcells.info
nachathegift.info
nachatldgenerals.info
nachatpain.info
nachawebsiteo.info
nachawmagazine.info
nachaxserver.info
nachay.info
nachaycamp.info
nachayoucant.info
nachayourock.info
nachazsong.info
newgach.info
newirs-report-download-link-5463.info
newirs-reports-web-6743.info
newnacha-add-tools.info
newnacha-c.info
newnacha-site-y.info
newre-ach.info
newtransfer-c.info
newtransfer-d.info
newz-transfer.info
nhachoc.info
o-transfers.info
q-ach-payment.info
q-achshop.info
report-nacha-domain-3322today.info
report-nacha-domain-33252blog.info
report-nacha-domain-33252online.info
report-nacha-domain-3829online.info
report-nacha-domain-3829store.info
report-nacha-domain-6865s.info
report-nacha-name-6865.info
reportnachadomain2433.info
reportnachadomain33252.info
reportnachaname3322.info
review-nacha-domain-33252.info
thedomainnachatools.info
theirs-report-download-link-6744.info
theirs-reports-web-file-56745.info
thenacha-h.info
thenacha-j.info
thenacha-p.info
thenacha-u.info
thenacha-x.info
thenachabusinessdomain.info
thenachapendingreports.info
thereport-nacha-domain-3322.info
thereports-nacha-domain-3567.info
v-achtoday.info

Regards,
Beth Young and Kris Trower
MOREnet Security Analyst
(800) 509-6673

Follow us on Twitter!
http://twitter.com/#!/morenetsecurity
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk4xdy4ACgkQwqygxIz+pTs1LQCgqt/0C9yR6Wt0JJdfo0VNQkz9
+BwAoLXGQXGKB/qVXUBD8dp4IrPeoC6X
=8jjI
-----END PGP SIGNATURE-----