From the that-didn’t-take-long department, the recent death of North Korean dictator Kim Jong-il has taken its predicted path through social media and spawned malicious spam that takes advantage of exploits in PDF to infect computers with a Trojan.

Researchers at TrendLabs discovered the spammed messages in their inboxes with subjects mentioning the death of Kim Jong-il.

The messages arrive with a PDF file attachment named brief_introduction_of_kim-jong-il.pdf.pdf. According to the brief the Trojan is detected as TROJ_PIDIEF.EGQ. While it’s attempting to infect the victim computer it opens a non-infected PDF with an image of the late world leader and the headline, “N Korean leader Kim Jong-il dies.”

Aside from this particular spam attack, we’ve also encountered malicious documents which bear file names mentioning the late Korean leader. One of the files we saw has the file name Kim_Jong_il___s_death_affects_N._Korea___s_nuclear_programs.doc and is now detected as TROJ_ARTIEF.AEB. This file, when opened, drops another file into the system, one detected as BKDR_PCCLIEN.BQD. BKDR_PCCLIEN.BQD connects to its C&C server through port 8000.

It is unknown at this time what PDF exploit the TROJ_PIDIEF.EGQ Trojan uses to compromise victim systems; but just to be on the safe side, we advise everyone to update their Adobe Reader PDF viewer and antivirus definitions for the upcoming Christmas holidays. Adobe recently released a hotfix for several

In the rough-and-tumble world of malicious spam and malware, the death of a celebrity often triggers a widespread bandwagon by cybercriminals to jump on and exploit people’s desire to receive news on the subject. As a result, as the death trends in media such as Facebook, Twitter, and G+ malware makers get to work fashioning likely looking e-mails and links to spread on those networks. We’ve seen this with the death of Amy Winehouse, when Osama bin Laden was killed by US forces, and even after the passing of Apple’s once-and-future CEO Steve Jobs.

Always be on the lookout for strange, but enticing, documents received from untrusted sources—and also potentially from trusted sources. Always scan documents coming in from e-mail, especially if they’re about recent events and come in formats that often contain exploits such as PDF, Flash, and Word documents.

Most news about Kim Jong-il or any other celebrity death will probably come through news media and in the plain text of e-mails—rich media documents via e-mail is a common and obvious vector for malware.