Six botnets spew 85 per cent of spam

gallery

A security monitoring team has identified six botnets it said are currently responsible for 85 per cent of all spam.

Following the recent dominance of the Mega-D botnet, Marshal's TRACE team said it has now been overtaken by the Srizbi botnet, which is now responsible for distributing the lion's share of spam - 39 per cent - followed by the Rustock botnet, which is responsible for 21 per cent.

Three weeks ago, the same security team reported the Mega-D botnet was the leading source of spam with a 35,000-strong botnet that responsible for malware called Ozdok. The subsequent discovery of Mega-D's control servers saw spam sent from this botnet drop to zero during mid-February.

This week, Mega-D bounced back to represent 21 per cent of spam after a 10-day period of inactivity. Ed Rowley, Marshal technical consultant told IT Pro this activity suggests these botnets are being controlled by increasingly concentrated numbers of gangs.

"Whose to say they weren't resting Mega-D to promote the Srizbi botnet in its place," he said. "Or we may have just spooked the spammers into taking the Mega-D control servers offline."

Owing to the break, Mega-D only accounted for an average of 11 per cent of spam during February. At its peak last month, it was responsible for a third of all the spam Marshal caught in its spam traps.

As Rowley observed, this has left the way for Srizbi to emerge as the leading spam botnet in February. He said it is particularly advanced and extremely stealthy malware. "Srizbi is much better at hiding itself using rootkits that run at kernel level and inject malware into the operating system from there," he added.

Marshal also found other significant active spam botnets at this time include: Hacktool.Spammer (which has multiple aliases including Spam-Mailer) and the Pushdo family (alias Pandex and Cutwail) which, like Srizbi, is also known for mass spamming of its malware with celebrity hooks.

Perhaps surprisingly, the notorious Storm botnet, which emerged last year, is comprised of an estimated 85,000 bots and currently responsible for only three per cent of spam volumes.

But Marshal added that the size of a botnet, measured by how many bots it has, does not necessarily correlate with how much spam it sends. Its TRACE team has observed huge variations in the rate at which different spambots pump out spam.

Mega-D is known for concentrating on male enhancement pills called 'Megadik' or 'VPXL' under such brand names as 'Express Herbals' and 'Herbal King'. In addition to Mega-D, other botnets including Srizbi, Rustock, Hacktool.Spammer and Pushdo, have been simultaneously sending spam with links to websites featuring the same 'Express Herbals' web page.

Email to a friend

Print this page