IRS-Themed Spam Delivers Ransomware

The US tax season is about to begin, and right on cue, a new IRS spam campaign has bubbled up in email boxes.The emails claim to be refund notifications from the IRS. But they include a .zip attachment that, when opened, will deliver a mix of payloads. The primary baddie seems to be the multifaced Trojan Kovter, and the secondary one is CoreBOT—not exactly good tidings from the tax man. “Who wouldn’t want to know if they’re really getting a tax refund from the IRS?” said researchers at Heimdal Security, who first noticed the campaign. “But don’t let your curiosity get the best of you: Not only is it a fake email, but it also carries plenty of danger within.” Kovter carries out click-fraud operations and delivers malware on the PCs it infects.