'Audit and Assurance' Email Virus

SDBbot, a Remote Access Trojan that first appeared a few years ago appears to be active once again. An unknown group of cybercriminals is distributing copies of the SDBbot Trojan worldwide by using fraudulent email messages that use the subject 'Audit and Assurance.' It is likely that the emails will be send to companies and institutions, but there is a possibility that the crooks behind the 'Audit and Assurance' Email Virus may target regular users as well.

The fraudulent email messages are very lengthy, and they are designed to look as if they were sent by a legitimate company that asks the victim to review an invoice – of course, most users would immediately try to review the file to find out what it is all about. However, upon opening the malicious file attachment, the user would trigger a malicious macro script that has the purpose of deploying and running the SDBbot payload. To make matters worse, the fake invoice will display a decoy document that will keep the user engaged while the SDBbot runs in the background.

By using active SDBbot implants, the criminals behind the 'Audit and Assurance' Email Virus attack can steal important files, spy on their victims, log keystrokes, or exfiltrate sensitive data. Needless to say, falling for the 'Audit and Assurance' Email Virus scam can be very dangerous. We advise you to be wary of such emails in the near future, and to make sure that your system is protected by a trustworthy anti-malware too.