Select Page

Cyren Security Blog

The Cyren Security Blog is where Cyren engineers and thought leaders provide insights, research and analysis on a range of current cybersecurity topics.

Updated: NACHA Payment cancelled – scam continues

In February 2011, NACHA alerted the public about fraudulent emails being distributed that appeared to be sent from NACHA and signed by a non-existent NACHA employee. We reported this campaign back in June 2011 but it has come back in the past 2 weeks with a new twist to trick the users into opening a malicious executable. The email (shown below) includes a URL link to “the report”.

Email text

The ACH transaction (ID:———), recently initiated from your checking account (by you or any other person), was cancelled by the other financial institution.

Rejected transaction

Transaction ID: ———-

Transaction Report:——-

Clicking the link doesn’t lead to “” but to the malicious site which prompts for the download of an executable file as seen below.

We detect the downloaded file “report_270918123.pdf.exe” as W32/Zbot.BDD. This variant of zbot uses pseudo-random domain names and attempts connections with each to download a configuration file as seen below. This malware focuses on stealing sensitive financial data (email credentials, online banking login details, etc.).

The IP addresses above belongs to Dankon Ltd. in Russia. We recommend blocking the following range of IP addresses “ –” which belongs to Dankon Ltd.


According to, NACHA itself does not process nor touch the ACH transactions that flow to and from organizations and financial institutions. NACHA does not send communications to individuals or organizations about individual ACH transactions that they originate or receive. So don’t be fooled by this ACH transaction email scam.


A new variant of the downloaded NACHA file uses Adobe Flash Exploit – CVE-2011-0611 and Java Plugin LaunchJNLP DocBase Exploit – CVE-2010-3552 to be able to download and execute a binary file from the URL “hxxp://”. We detect this malware as W32/Zbot.BDD.

Updating Adobe Flash Player and JAVA Plugin to their latest versions will protect you against this threat.

We recommend blocking the IP addresses and

You might also like

Phishing with QR codes

Don’t Scan or be Scammed By Maharlito Aquino, Kervin Alintanahin and Dexter To In 1994, a type of the matrix barcode known as the Quick Response code, now widely known as QR code, was invented by Masahiro Hara from a Japanese company Denso Wave. The purpose of the...