After luring unsuspecting users into its trap with Labor Day postcards and NFL kickoffs, Nuwar (a.k.a. Storm Worm) has now switched to “free games” bait:
or

If you’re gullible enough to follow that link, it will take you to a convincingly enough looking Web page loaded with games images and an unpleasant surprise–a cocktail of exploits and downloaders:

So if you’re not running an on-access anti-virus product, you’re already in trouble. Anyway, the page itself looks like this (complete with broken images):

It promises “1000+ free games,” but whatever icon you click you get nothing but Nuwar in a file named ArcadeWorld.exe.

September 17th, 2007 at 9:58 pm
Looks like you’ve missed obfuscating the ip address on the On-Access scan message
And the images could sure use a little resizing…
June 9th, 2008 at 1:20 am
Thanks for all this.