Email spam targeted at a pair of users

Question

Two users on my domain are receiving spam emails that have both of their emails in either the To: and/or CC: fields. There are many other users on the domain, but only these two are receiving spam emails. The two accounts are not exclusively linked or associated (eg. only two of them belonging in the same group)

Over the last few days, both have received hundreds of messages (the same messages essentially). There is a spam filter on the mail server in place but its the fact that they're both getting the same spam messages that I'm wondering about.

The headers indicate that they're coming from spam servers all over the world. Each email is different (sample copied below, replaced private information with mail.mydomain.com etc.)

Received: from max (5.178.191.234) by --mail.mydomain.com--
 (X.X.X.X) with Microsoft SMTP Server id X.X.X.X; Fri, 27 Sep 2013
 04:48:43 -0700
Received: (from root@localhost) by mail0.wiktionary.org (8.11.3/8.11.3) id
 k8V5OhN08473; Fri, 27 Sep 2013 11:48:43 -0300 (PDT envelope-from root)
Date: Fri, 27 Sep 2013 10:55:07 -0300
Message-ID: <80252799905272.ZBiaUKfUeG@smithereens>
X-Mailer: phpmailer [version 1.41]
X-BeenThere: [email protected]
X-Kaspersky: Checking 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
To: <[email protected]>, <[email protected]>
From: Get BIGGER with Free trial <[email protected]>
Subject: Disappointed at your lack of performance?
MIME-Version: 1.0
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: --mail.mydomain.com--
X-MS-Exchange-Organization-AuthAs: Anonymous

My question is what is the most reasonable explanation for both users to be in the To: and CC: fields of spam?

At first, I thought domain attack, but then why only two users? Or if it is a single user being compromised, then why is it only spamming one other user when it has a whole address book? Another idea is that this is a targeted attack against the two, but is that possible? Is there some spam machine that someone could dunk two names into and be put on a list to be spammed together? I could understand both being on the same list and spamming individually, but together? It seems incredibly bizarre.

Answer 1

A plausible hypothesis is the following:

• The spammer optimizes his spam-sending by grouping targets from the same domain: when a spam must be sent to [email protected], [email protected] and [email protected], then the spam software sends a single email to the incoming SMTP server of example.com, with the three addresses as recipients. Email grouping is good for bandwidth, and this benefits the spammer as well.

• The spam themselves are sent through a botnet, so they seem to come from "the whole planet" with no single source.

• The spammer has collected a lot of addresses, including the addresses of these two users, but none other. Why ? Because neither of the two users got his machine compromised in any way. It is someone else, completely outside of your organization, who installed malware on his machine; and that third person, that you don't know and over which you have no control, had the two users' email addresses in his address book.

  It is an unfortunate property of spamming that you get spammed because of the sloppy behaviour of other people.

Don't forget, too, that spammers are not necessarily good at what they do. I regularly receive weird spams: empty messages, spams whose text contents is "%INSERT_RANDOM_CONTENT", hundreds of copies of a single spam... A lot of wannabe spammers appear to have difficulty using their own spamming tools. As usual, incompetence is a driving force of the Universe and explains a lot of the observed weirdness.

Answer 2

It could be a result of the way the spammer harvested the two victims' email addresses in the first place. Spammers love to get ahold of emailed chain letters, as they provide a long list of pre-validated addresses. It's also possible that both employees were signed up on the same web server that was later compromised.

No matter how it happened, tracking the addresses down to the original source of the leak is rarely likely to produce actionable results. The most benefit you could likely gain would be to provide it as an example of exercising caution to the rest of your employees.