If you receive an email with a Microsoft Word document attachment named as “MERS_List of hospital and infected patient” or something similar from an unknown sender, it is better to ignore it. Symantec in its report, has revealed that cyber criminals are “taking advantage of the outbreak of Middle East Respiratory Syndrome (MERS) in South Korea and other regions to spread Trojan.Swort through spam emails.”
Symantec says that the malware is spreading through emails and is a simple .exe file that poses as a Microsoft Word document. The file name is written in Korean and translates as “MERS_List of hospital and infected patient.docx.exe”.
“During our analysis of the sample, we confirmed that it’s not a sophisticated threat. Instead, it’s a simple downloader that we detect as Trojan.Swort. Our research found that the remote host which the malware is configured to connect to is not responding,” according to Symantec.