Trojan Makes Printers Go Potty The World Over

A Trojan that sends printers crazy, making them print pages of  garbled nonsense until all the paper has been used up, has seen a spike in activity.

Symantec detected the Trojan.Milicenso across various countries, but the worst hit regions were the US and India followed by regions in South America and Europe, including the UK.

Trojan.Milicenso has surged in the last two weeks, but was originally detected in 2010. It infects users’ systems in various ways, including via drive-by downloads and malicious email attachments. Its main aim is not to make printers go crazy, however, but to act as a “malware delivery vehicle for hire”.

Decoy method

The Trojan is somewhat unique in that it  uses adware as a decoy “to distract attention from itself, thereby attempting to avoid malware analysis as this would categorize it as low risk and be dismissed,” Symantec said in a blog post. It is also covered in encryption, making it hard for AV products to analyse.

Yet it makes printers go into overdrive because it loads a .spl file, ostensibly, but not really, for printer spooling.

“The .spl file, while appearing to be a common printer spool file, is actually an executable file and is detected as Adware.Eorezo. Depending on the configuration, any files, including binary files, created in that folder will trigger print jobs,” Symantec said in its blog post.

“This explains the reports of unwanted printouts observed in some compromised environments. Based on what we have discovered so far, the garbled printouts appear to be a side effect of the infection vector rather an intentional goal of the author.”

This side-effect of the malware makes it very easy for IT teams to detect that something is wrong. It does waste plenty of paper, however, and therefore this malware is also a tree murderer.

Are you potty for printers? Try our quiz!

Thomas Brewster

Tom Brewster is TechWeek Europe's Security Correspondent. He has also been named BT Information Security Journalist of the Year in 2012 and 2013.

Recent Posts

Bitcoin Value Reaches $63,000 Record High

The value of the Bitcoin cryptocurrency continues to fluctuate, but has now surpassed $63,000 in…

9 hours ago

Iran’s Natanz Cyberattack Blamed On Israel

Second Stuxnet? Iran's Natanz nuclear facility suffered another cyberattack at the weekend, with the finger…

11 hours ago

Google Founders Larry Page, Sergey Brin Personal Fortune Grows

Share surge in Alphabet over the past year allows founders Larry Page and Sergey Brin…

13 hours ago

Apple Teases New Devices With ‘Spring Loaded’ Event

New devices to be revealed next week may include new iPads, AirTags, or even augmented…

15 hours ago

Chip Shortage – Renault To Extend Idle Factories Until September

Three of Renault's four car factories in Spain will be partly idled until end of…

17 hours ago

NHS Website Crashes Briefly Amid Rush For Vaccine Bookings

After the government authorises Covid-19 vaccines for over 45s, NHS booking website crashes briefly under…

17 hours ago