Identity attack spreads; 1.6M records stolen from Monster.com

Infostealer.Monstres' second-stage attack, which uses Gpcoder, is especially insidious. Realistic-looking e-mails that contain convincing personal information -- the very information stolen from Monster.com -- instruct the recipient to download a program called "Monster Job Seeker Tool." There is no tool, of course; victims download the ransomware Gpcoder.e instead.

Hidalgo's research led him to conclude that the three pieces of code -- Infostealer.Monstres, Banker.c, and Gpcoder.e -- are related, and probably the work of a single group.

"While their final purpose is different, their modus operandi is very similar, using identical file names, creating the same system folder, injecting code into the same processes and hooking the same system functions using root-kit techniques to gain control of network functionalities and to steal sensitive information," said Hidalgo. "They share code and a number of traits that could indicate they were developed by the same group or perhaps created using a kit."

Monster.com's Sylven defended the service's automated searches and said that although the company monitors database activity, stolen credentials have been used in the past to access the system. Moreover, he said, it's difficult to tell a valid automated search generated by a real person from one cranked out by software. "Many of our larger customers rely heavily on our database, and their use may be similar to programmatic or scripted access," said Sylven.

He could not confirm that the stolen accounts had been disabled, although Hidalgo noted in a blog entry posted Friday afternoon that Symantec had notified Monster of the compromised log-ins. "When unusual access is detected, we do terminate that access and investigate if possible," Sylven said.

(See also "Your Data's Less Safe Today Than Two Years Ago.")