Experts uncovered a malspam campaign using Boeing 737 Max crash

Experts at the 360 Threat Intelligence Center uncovered a new malspam campaign that leverages the tragic Boeing 737 Max crash to spread malware.

Crooks always attempt to exploit the attention of the people on the events that made the headlines. In the last days, two events captured the attention of the media, the New Zealand mosque shooting and the tragic crash of the Boeing 737 Max in Ethiopia,

In the wake of the New Zealand mosque shooting, US CISA is recommending users to remain vigilant on possible scams and malware attacks.

Now experts at the 360 Threat Intelligence Center have uncovered a new malspam campaign that leverages the tragic Boeing 737 Max crash to spread malware. Crooks used spam messages that pretend to be leaked documents about possible crashes of the Boeing 737 Max.

Crooks are using #Boeing hashtag in their campaign, spam messages were sent by the allegedly compromised email account at @IsgecPresses (

Threat actors are using a JAR file as an attachment (i.e. MP4_142019.jar) that acts as a dropper for the Houdini H-WORM RAT, spam emails have subject lines similar to “Fwd: Airlines plane crash Boeing 737 Max 8“.

These emails pretend to be from a private intelligence analyst who found a leaked document on the dark web. This document pretends to contain information about other airline companies will be affected by similar crashes soon.

Below the text used by crooks that was shared by BleepingComputer.



I believe you have heard about the latest crash Boeing 737 MAX 8 which happen on sunday 10 march 2019, All  passengers and crew were killed in the accident

Ethiopian Airlines Flight ET302 from Addis Ababa, Ethiopia, to Nairobi, Kenya, crashed shortly after takeoff

The dead were of 35 different nationalities, including eight Americans.

On 29 October 2018, the Boeing 737 MAX 8 operating the route crashed into the Java Sea 12 minutes after takeoff.

All 189 passengers and crew were killed in the accident.

note: there was a leak information from Darkweb which listed all the airline companies that will go down soon.

kindly notify your love ones about the informations on these file.


Joshua Berlinger

private inteligent analyst

If a user attempts to open the JAR file, it will be executed by JAVA on the computer. This attachment was originally thought to only install the Houdini H-worm Remote Access Trojan, but security

Security researcher Racco42 analyzed the JAR file after noticing its anomalous size and discovered running it through Any.Run that the malware was also installing the Adwind data-stealer Trojan.

Pierluigi Paganini

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.


10th Anniversary Exclusive Top 100 CISO Conference & Innovators Showcase