[sniffer] Re: New campaign not caught

[Pete McNeil]

Hello Chris,

The blackhats have been using some new tactics in the past 3 days.

It appears that they paused for a couple of days before that to prepare the new campaigns, tactics, and machinery.

Two of their most recent bursts were so "violent" that we had a bit of a challenge responding to them.

I've just finished some retooling that should help us respond to the next storm with more fluidity.

So far the new systems on this side appear ready to go and are performing as expected.

If they keep up to their predicted schedule then we will know more within the next 8 hours.

We're all on the lookout for it.

_M

Wednesday, August 8, 2007, 10:44:56 PM, you wrote:

>

What is up with the PDF spams? They are getting thru the filters like crazy for the past few days…   Thank You, Chris Bunting Lancaster Networks Direct: 717-278-6639 Office: 888-LANCNET x703 3com IP Telephony Expert -------------------------------------------------------- Lancaster Networks 1085 Manheim Pike  Lancaster PA 17601  www.lancasternetworks.com ---------------------------------------------------------------------- Corporate Technology Solutions... Specializing in 3com NBX Telephony Solutions IT Services - Phone Systems - Digital CCTV HP Computers/Servers & Printers ---------------------------------------------------------------------- The information in this e-mail is confidential and may be privileged or subject to copyright. It is intended for the exclusive use of the addressee(s).  If you are not an addressee, please do not read, copy, distribute or otherwise act upon this email. If you have received the email in error,  please contact the sender immediately and delete the email. The unauthorized use of this email may result in liability for breach of confidentiality, privilege or copyright.   From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Tuesday, August 07, 2007 2:44 PM To: Message Sniffer Community Subject: [sniffer] Re: New campaign not caught   Hello Scott,   We have been working on both and we've made progress.   There are a number of other variants and campaigns all with high bandwidth we are also working on.   _M   Tuesday, August 7, 2007, 12:46:36 PM, you wrote:   >  Last night I started getting spam with numbers in the subject and a hex code in the body.   This morning that switched over to stock spam PDFs.   Hopefully rules can be targeted towards them!   Scott Fisher Dir of IT Farm Progress Companies 191 S Gary Ave Carol Stream, IL 60188 Tel: 630-462-2323   This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. Although Farm Progress Companies has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments.           --  Pete McNeil Chief Scientist, Arm Research Labs, LLC. #############################################################   This message is sent to you because you are subscribed to     the mailing list <sniffer@sortmonster.com>.   To unsubscribe, E-mail to: <[EMAIL PROTECTED]>   To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>   To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>   Send administrative queries to  <[EMAIL PROTECTED]>

-- 

Pete McNeil

Chief Scientist,

Arm Research Labs, LLC.

#############################################################
This message is sent to you because you are subscribed to
  the mailing list <sniffer@sortmonster.com>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to  <[EMAIL PROTECTED]>