A new Valentine's Day-themed spam campaign has been created by the hackers behind the Storm virus, which infected the web last year, say security experts.

MX Logic, Trend Micro and Panda Security have all reported new spam emails that are trying to dupe web users into installing the Waledec bot Trojan.

Subject lines for the spam, said Sam Masiello, vice president of information security at MX Logic, are "short and sweet" and include 'me and you', 'in your arms' and 'with all my love'. From the spam, users who browse to the embedded link reach a site with a dozen hearts, any one of which download an executable file when clicked.

Both Masiello and Florabel Baetiong, an antispam research engineer with Trend, noted the similarity between the recent infection attempt and Valentine's Day scams launched last year by hackers controlling Storm, another bot Trojan that has since fallen into disuse, possibly because the crew responsible surrendered to heavy pressure by security experts .

"Clearly the old Storm folks are working as hard as they can to build up their new botnet, and are following the old tried-and-true methods of centering their social-engineering tactics around holiday themes," said Masiello in a post to the MX Logic blog.

"But it still impresses me that tactics like this continue to work and be so effective, despite how many times it gets recycled," Masiello said.

Storm used Valentine's Day spam in both 2007 and 2008 to hijack PCs.

Most researchers have come around to the idea that Waledec is, in fact, the new Storm. Joe Stewart , an expert on botnets - Storm, in particular - was confident that the group that backed Storm essentially re-wrote its code to come up with Waledec.

"If it's not the same people, they would have had to study Storm intensively to match the functionality," Stewart said in an interview recently. "It's so similar that it's unlikely to be a different group."

Waledec has been busy of late. The malware first began infecting systems just before Christmas, when it used phony holiday greetings and ecards as bait, another Storm tactic during 2008. Last week, it surfaced again, this time hitchhiking on a spam run that claimed then President-elect Barack Obama would not take the oath of office on January 20.

Although the Waledec botnet remains relatively small - Stewart put it at just 10,000 machines - it's growing at "an alarming rate", according to MessageLabs. In a report on botnets, the email security company speculated that the botnet owners are "focusing on growing and developing this new botnet, rather than sending spam through it at this stage".

Masiello said that messages designed to plant Waledec were running at a volume of about 4,000 to 5,000 per hour at the start of this week, down from approximately 12,000 an hour last Friday, and had been holding steady for the last 48 hours.

"I'd agree with MessageLabs," said Masiello. "It does look like they are in the process of building up the botnet." MX Logic has not seen any evidence that the Waledec botnet is, in turn, sending spam of its own.

Several botnets that were heavily disrupted by the takedown of McColo, a US hosting company, are in the same condition, Masiello added. After suffering losses when McColo - which had hosted command-and-control servers for several botnets, particular one dubbed 'Srizbi' and other called 'Rustock' - was yanked off the internet, they have spent the last several months adding new PCs to their collection.

Computerworld (US)

See also: Spam levels up 156% after McColo takedown