Do 'pump and dump' spam campaigns really work?

March 2007

Over the last few weeks, the users of German webmail accounts at web.de and gmx.de have received a lot of 'pump and dump' spam emails written in German. These emails advertise the stock of a German venture capital company - which, according the email, is expected to grow radically within a week.

The spam messages state that on 12 March 2007 the company's share value was 12 cents. We decided to check this value and to watch what happened to it over the next couple of days. According to a well known German investment portal the company's share value was indeed 12 cents on 12 March, and by 14 March 2007 it had gone up to 19 cents - representing a 58% increase in just two days.

As shown in the table below (the prices are snapshots taken at the beginning and close of the day), the stock's growth rate over the previous week had been 91% and in the previous four weeks 127%. The stock seems to be moving well.

Value per share

A chart of the stock values over the previous six months shows that the stock value started off low and its value did not fluctuate much until approximatively the second week of March 2007 - when its value suddenly more than doubled. This coincides exactly with when we first started to receive the spam emails in large numbers.

Stock's value over six months

The following targets were advertised in the spam email on 12 March:

    7-day target: 32 cent/share (this means 266% growth rate)
    4-weeks target: 1 euro/share (this means 526% growth rate)

Of course, these targets are extremely over estimated, but it seems that some people did buy the shares advertised in the spam messages, and this raised the share price artificially to more than half than the original price.

The spam campaign appears to have produced the desired results, and by Friday 16 March, just four days after the 'pump' appeared, the spam had almost dissapeared.

The company whose shares were the subject of this spam campaign seems to be legitimate and - as is very often the case with this type of campaign - appears not to be involved with the spam in any way (for privacy purposes, we can not disclose any detailed information about the company).

Sorin Mustaca, Avira

[Earlier this month, the US Securities and Exchange Commission (SEC) announced that it was suspending trading in the stocks of companies that had been used in similar 'pump-and-dump' spam campaigns. See here for more details.]

Quick Links

Poll
Should software vendors extend support for their products on Windows XP beyond the end-of-life of the operating system?
Yes - it keeps their users secure
No - it encourages users to continue to use a less secure OS
I don't know
Leave a comment
View 24 comments

Jobs Recruit Sidebar

Virus Bulletin
In this month's magazine:
  • VBSpam comparative review March 2014
  • VB100 comparative review on Ubuntu Server 12.04LTS
  • The shape of things to come
  • Threat intelligence sharing: tying one hand behind our backs
  • The curse of Necurs, part 1
  • More fast or more dirty?
  • Tofsee botnet
  • Back to VBA
  • Is the security industry up to the new challenges to come?
  • Greetz from academe: No place to Hyde
Virus Bulletin 04 2014
Subscribe now!

Virus Bulletin currently has 231,335 registered users.