The Latest in IT Security

These (rather confused) spam emails lead to malware on cms-wideopendns.com:

From: LinkedIn Communication [mailto:[email protected]]
Sent: 16 July 2012 15:12
Subject: We have received your payroll processing request.

Direct Deposit Service Communication
Status update

Dear victim
We received your payroll on July 16, 2012 at 1:16 AM Pacific Time.
•    Funds will be withdrawn from the bank account number ending in: XXXX on July 17, 2012.
•    Amount to be withdrawn: $2,476.11
•    Paychecks will be deposited to your employees’ accounts on: July 17, 2012
•    Please download your payroll here.
Funds are as a rule processed before normal banking hours so please make sure you have sufficient funds available by 12 a.m. on the date funds are to be withdrawn.
Intuit must receive your payroll by 5 p.m. Pacific time, two banking days before your payment date or your employees will fail to be paid on time. QuickBooks does not process payrolls on weekends or federal banking holidays. A list of federal banking holidays can be downloaded at the Federal Reserve website.
Thank you for your business.
Sincerely,
Intuit Payroll Services

IMPORTANT NOTICE: This notification is being sent to inform you of a critical matter concerning your current service or software. Please note that if you previously opted out of receiving marketing materials from Intuit, you may continue to receive notifications similar to this communication that affect your service or software.
If you have any questions or comments about this email, please DO NOT REPLY to this email. If you need additional information please contact us.
If you receive an email message that appears to come from Intuit but that you suspect is a phishing email, please forward it to immediately to [email protected].
Copyright 2008 Intuit Inc. QuickBooks and Intuit are registered trademarks of and/or registered service marks of Intuit Inc. in the United States and other countries. This notification is not intended to supplement, modify, or extend the Intuit software license agreement between you and Intuit for any Intuit product or service.
Intuit Inc. Customer Communications
2800 E. Commerce Center Place, Tucson, AZ 85706

====================

From: LinkedIn Communication [[email protected]]
Sent: Mon 16/07/2012 15:12
Subject: Your payroll processing is initiated by Intuit.

Direct Deposit Service Communication
Status update

Dear victim
We obtained your payroll on July 16, 2012 at 7:36 AM Pacific Time.
•    Funds will be withdrawn from the bank account number ending in: XXXX on July 17, 2012.
•    Amount to be withdrawn: $5,582.11
•    Paychecks will be deposited to your employees’ accounts on: July 17, 2012
•    Please download your payroll here.
Funds are typically withdrawn before normal banking hours so please make sure you have sufficient funds available by 12 a.m. on the date funds are to be withdrawn.
Intuit must receive your payroll by 5 p.m. Pacific time, two banking days before your payment date or your employees will fail to be paid on time. QuickBooks does not process payrolls on weekends or federal banking holidays. A list of federal banking holidays can be downloaded at the Federal Reserve website.
Thank you for your business.
Sincerely,
Intuit Payroll Services

IMPORTANT NOTICE: This notification is being sent to inform you of a critical matter concerning your current service or software. Please note that if you previously opted out of receiving marketing materials from Intuit, you may continue to receive notifications similar to this communication that affect your service or software.
If you have any questions or comments about this email, please DO NOT REPLY to this email. If you need additional information please contact us.
If you receive an email message that appears to come from Intuit but that you suspect is a phishing email, please forward it to immediately to [email protected].
Copyright 2008 Intuit Inc. QuickBooks and Intuit are registered trademarks of and/or registered service marks of Intuit Inc. in the United States and other countries. This notification is not intended to supplement, modify, or extend the Intuit software license agreement between you and Intuit for any Intuit product or service.
Intuit Inc. Customer Communications
2800 E. Commerce Center Place, Tucson, AZ 85706

LinkedIn? Intuit? The bad guys are confused, but these are dangerous emails nonetheless. The malicious payload is at [donotclick]cms-wideopendns.com/main.php?page=bfc8be54a0120bca (report here) hosted on the following IPs:

211.157.105.160 (Chinacomm, China)
109.164.221.176 (Swisscom, Switzerland)

The following IPs and domains are all connected and should be blocked:
46.20.33.131
62.109.26.35
80.77.87.185
108.76.72.229
109.164.221.176
164.15.250.148
195.54.32.91
198.144.189.51
211.157.105.160

afriget.net
cms-wideopendns.com
fonografs.net
peace-computer.com
proamd-inc.com
thaidescribed.com