Tag Archive for 'xmas'

Christmas greetings from Koobface to abuse.ch

Most of the time I’m aware of the users which are reading my blog frequently… But I have to admit that I was really suprised today.

Recently I took a look into the Koobface trojan and it’s infrastructure. The result of my research was the post “Koobface – the social network trojan“.

Today, while I read thru my favorit blogs, I came across the post The Koobface Gang Wishes the Industry “Happy Holidays” at Dancho Danchev’s blog. It tells that the cybercriminals behind the Koobface trojan just published a Merry Christmas wish on the fourth (and final stage) of their infection process.

If you scroll down at the end of the page the following text appears:

When you read thru the text above, you will ask yourself “who is Soren Siebert”? I just asked me the same question, but I have an answer on this. When you look at the HTML Source code of the page, you will see that the text “Soren Siebert with his great article” refers to my post about the Koobface trojan:

Soren Siebert with his <a href="http://www.abuse.ch/?p=2103" target="_blank" >great article</a>

People how knew me personally also know that my real name isn’t Soren Siebert. Let me explain how the Koobface gang came across this name. On my blog you will find a reference to a disclaimer page in the navgiation bar. The disclaimer is written in german and was generated with a impressum generator provided by e-recht24.de. The webpage and the impressum generator is maintained by a laywer called Sören Siebert, which is also mentioned as source of the text on my disclaimer. So the Koobface gang just came across this name on my disclaimer and thought that this is my name.

Anyway, I’m a bit proud that the Koobface gang read my post about their trojan and the fact that my post was mentioned in the same way as well-known Antivirus vedors like Kaspersky and Trend Micro. That was a great Xmas gift from the Koobface gange – thank you! :)