SUMMARY Spammers, virus writers and hackers were once distinct communities with distinct motivations. However, the success of spam has brought the three together in an underground economy with a single purpose: to make money from unsolicited email. This paper examines how the convergence of the spam and virus threats is developing a new spam economy. It details the level of protection that businesses need to combat the threats, and demonstrates how Sophos can help keep organizations spam- and virus-free. A glossary of spammers’ tricks and related terms is included at the end of the paper. Introduction The spammers’ goal is simple – to make money from unsolicited commercial email, either from their own scams or products, or on behalf of other parties, such as porn or gambling sites. With more and more organizations deploying antispam protection, accomplishing this goal has become much harder for spammers and has led to the emergence of an elaborate industry that constantly develops, tests and adapts new tactics to defeat an organization’s filters – something virus writers have been doing for years. Spammers are turning to various illegitimate providers more often to meet the demand for the specialized tools and services needed to make spamming more effective. The various relationships include: ? Virus writers and hackers supplying the infrastructure needed to deliver spam. ? Spammer services supplying specialized skills and resources. ? Spamming software coordinating spammer services and managing campaigns. While it is true that people still write viruses for other reasons, an economic incentive is driving innovation in the virus and hacker communities in a different direction – namely quietly hijacking, rather than noisily vandalising, computer systems. Previously, these groups just wanted to gain notoriety, which meant causing obvious damage. Now they have a financial incentive, which changes the aim of viruses and makes everyone a target. ......