IMlogic Threat Center Upgrades the Threat Level of the Opanki Variant Due to Significantly Increased Detection of the IM.PIC22.AIM Worm.

IMlogic--

WHAT:   Industry leader IMlogic (www.imlogic.com) is warning customers
        that the IM.Pic.22AIM and the Opanki.AC worms are propagating
        over leading instant messaging networks. These worms
        distribute URLs to user buddy list contacts which connect to
        malicious payloads. The malware carries along Trojan horse
        software including, but not limited to, SDbot to open security
        back doors, rootkit software which remain undetected by
        security software, and Internet Relay Chat (IRC) backdoors to
        notify attackers of the infection and give them control over
        compromised machines.

        This worm was previously found with low distribution, but
        based on increased reports to the IMlogic Threat Center,
        IMlogic is raising the alert level to medium.

        Similar in propagation to earlier IM worms, the Opanki.AC and
        IM.Pic.22AIM worms leverage social engineering to trick users
        to download and install the worm. After installation the worm
        hijacks end user clients and sends personalized messages to
        each member of IM "buddy lists" that are currently on-line.
        The susceptibility of users to these types of attacks has
        stemmed from the fact that all viruses propagated over IM have
        thus far come from known buddies, so end users are receiving
        messages from trusted IDs with whom they have previously
        interacted.

        IMlogic Threat Center automatically detected, quarantined and
        blocked these threats using the IMlogic Real-Time Threat
        Protection System (RTTPS). RTTPS automatically protects
        against these new, unknown IM threats by providing in depth
        analysis of client and message structure to identify virus
        propagation behavior. This protocol level analysis allows the
        system to predicatively block and validate potential threats,
        while immediately protecting the IMlogic Threat Center
        Community. IMlogic recommends organizations strengthen
        additional security protection by ensuring all desktop
        antivirus solutions are updated, the latest security patches
        have been applied to all desktop systems, and that all out of
        date IM clients have been blocked from accessing the relevant
        IM networks.

WHO:    Experts from the IMlogic Threat Center can speak with
        technology and business reporters, industry analysts,
        enterprises, partners or anyone concerned about the impact of
        this threat. IMlogic can also offer commentary involving
        increased risk from IM worms, viruses and other security
        threats related to the growing popularity of IM use within
        enterprise.

MORE INFO: Learn more at IMlogic's Threat Center:
http://www.imlogic.com/im_threat_center/index.asp.

Disclaimer

The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

IMlogic, IMlogic products and IMlogic IM Manager are trademarks of IMlogic Corporation and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.