History and stories
The Storm Worm rode the headlines
The email subject read “230 dead as storm batters Europe.” Readers who opened the attachment let the attackers in.
1 min readStory
The short version
In January 2007, a deadly European storm became the subject line for one of the largest malware outbreaks of its time.
The story
In January 2007, a powerful windstorm swept across Europe and caused many deaths. On January 19, emails began arriving with the subject line “230 dead as storm batters Europe” and an attachment that seemed to promise more details.
The attachment installed malware on Windows computers. The infected computers were quietly joined to a botnet, a network of machines under the attackers’ control, used to send more spam and run other attacks.
Over the following weekend, the attack came in several more waves, and the subject lines kept changing to follow the news: wars, celebrity stories and political events, real or invented. It grew into one of the largest botnets of the time.
Why it mattered
Storm showed how attackers use the day’s news to get emails opened, changing their bait as fast as the headlines changed. It also showed what captured computers are used for: sending more scams, at enormous scale, from machines whose owners have no idea.
The lesson today
Attackers watch the news as closely as anyone. Disasters, elections, holidays and big sporting events all become subject lines. Emails that ride a breaking story and push you to open an attachment or click a link are a pattern worth recognizing.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.