A security researcher has recently reported that the ongoing attacks using malicious PDF files are caused by one of the most notorious Russian hacker groups, called the Russian Business Network of RBN.

So, according to Ken Dunham, iSight Partners Inc.’s director of response, it is the Russian Business Network’s members that are behind the recent attacks that use malware-armed PDF attachments. These malicious PDF files have started to appear in the users’ email accounts’ inboxes starting this Tuesday and they have already started to succeed in infecting the Windows systems, which have been their initial targets.

This type of attack is installing on the infected computer system a pair of rootkit files that “sniff and steal financial and other valuable data”, as Ken Dunham has said. The computers could easily get infected because the Russian cybercrimilas use PDF documents that seem to be quite all right. However, the corrupted PDF files are being sent through spammed emails and arrive with filenames such as YOUR_BILL.pdf, BILL.pdf, STATEMENT.pdf or INVOICE.pdf

The Russian hackers have exploited the “mailto:” protocol vulnerability that has been disclosed by the U.K.-based security researcher Petko Petkov. The users have just to open the attacking PDF file, and the Trojan called Pidief.a is already launched and knocks out the Windows firewall. Pieces of malware are downloaded the computers is compromised. This is why this represents a highly dangerous type of attack and we all should be careful with the PDF spamm email.