The security vendor SecureWorks has traced the virus to a cyber-jihad group called Tariq ibn Ziyad, named after an 8th-century Muslim conquerer of Spain (also the name of the “Minnesota Madrassa” we have covered here, if the name seems familiar). The symbolism of the name is indeed telling.

“Cyber jihad group linked to ‘Here you have’ worm,” by Robert McMillan for Computer World, September 10:

IDG News Service – A fast-spreading e-mail worm that crashed systems Thursday may be linked to a cyber jihad organization called Tariq ibn Ziyad, according to security vendor SecureWorks.

The “Here you have” worm spread like wildfire through some computer networks, bringing e-mail servers down and reportedly disrupting large U.S. organizations including Disney, Proctor and Gamble, Wells Fargo, and NASA (National Aeronautics and Space Administration). It’s known as “Here you have” because that is sometimes the subject line of the messages used to spread the malware.

Much of the worm’s code is identical to an earlier piece of malware that was released last month, and both worms refer to a Libyan hacker who uses the name Iraq Resistance, who has been trying to form a hacking group called Brigades of Tariq ibn Ziyad, said Joe Stewart, director of malware research with SecureWorks.

“Either this person is involved with this virus, or somebody wants to make it seem like this person’s group is involved in this virus,” Stewart said. “There are a lot of pointers to that group.”

The goal of Tariq ibn Ziyad is “to penetrate U.S. agencies belonging to the U.S. Army,” Iraq Resistance said, according to a Google translation of his post announcing the group.

Iraq Resistance did not respond to an e-mail sent to his Yahoo address seeking comment.

It’s not clear why the first version of worm did not spread widely last month — security vendor Symantec rated it a “low” risk — but Stewart said that the people behind it may have spammed more initial victims this time around. “Here you have” may also include new components that caused it to spread more effectively.

The August worm used the e-mail address Iraq_resistance@yahoo.com, and the words Iraq Resistance appear in the binary code of the latest version of the software. Also, a back-door component of the worm — which could be used by creators to remotely log into an infected system — tries to connect to a computer that uses the Tariq ibn Ziyad name. Other components of the worm — a password stealer and the e-mail sending software – were written by Arabic speaking programmers, another clue that Iraq Resistance may be behind the worm….