Chinese Government Sites Hosting Brazilian Malware

The Proofpoint Attack Response Center tells me that they've seen a number of spam messages aimed at Brazilian audiences. The Portuguese language messages contain links that purport to be racy photos, but of course they actually link to virus downloaders.

This in itself isn't particularly interesting (this type of blended threat is one of the main uses of spam these days), except that the sites hosting the malware were in the .gov.cn domain. That is, the infected sites are official Chinese government sites. In several cases, the links were still active.

Of course, nearly any site holds the potential to become infected and turned into a malware-distribution site through any number of different exploits. But the conspiracy-minded out there will wonder if China is engaging in some sort of cyber-attack.

(Just to be clear, that seems unlikely in this particular case, but feel free to discuss.)