Storm Worm Activity Related to April Fools Day

US-CERT is aware of a recent increase in Storm Worm activity. The latest activity is related to April Fools Day (April 1). This Trojan is spread via unsolicited email messages that attempt to convince users to follow a link to a malicious website. If a user follows this link, the Trojan may attempt to download and install itself on the user's system.

Currently, this variant of the Storm Worm Trojan is being observed as having the following file names:

• aromis.exe
• foolsday.exe
• funny.exe
• kickme.exe

• All Fools' Day
• Doh! All's Fool
• Doh! April's Fool
• Gotcha!
• Gotcha! All Fool!
• Gotcha! April Fool!
• Happy All Fool's Day
• Happy All Fools Day!
• Happy All Fools!
• Happy April Fool's Day
• Happy April Fools Day!
• Happy Fools Day!
• I am a Fool for your Love
• Join the Laugh-A-Lot!
• Just You
• One who is sportively imposed upon by others on the first day of April
• Surprise!
• Surprise! The joke's on you
• Today You Can Officially Act Foolish
• Today's Joke!

• Install anti-virus software and keep virus signature files up-to-date.
• Block executable and unknown file types at the email gateway.
• Do not open unsolicited email.
• Do not follow unsolicited links.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.