The Storm botnet is finally dead – but what's next?

gallery

The Storm botnet, which emerged in 2007 as one of the most disruptive pieces of malware, has faded away to nothing.

According to vendor Marshal, the spam coming from the botnet had been dwindling for months, finally stopping altogether this September.

The Storm botnet first really hit the headlines in January 2007, when it propagated to hit computer users in the UK, US and mainland Europe. Industry estimates for the number of computers infected at its peak ranged widely, but it was thought to be in between 500,000 and one million.

One weekend that January, it was particularly virulent as Storm embarked on unprecedented spamming campaigns for the time.

Between January and September 2007, the Storm tempest failed to die down, as it began to reinvent itself in different guises, a template for other spammers to develop their own botnets.

“Storm was one of the first botnets to use these tactics on a mass scale. It became the most successful botnet of its type and established the basic template for developing a spam empire that other botnets have since copied,” said Phil Hay, lead threat analyst for Marshal TRACE.

He added: “They also led the way in using self-perpetuating malicious spam to grow the botnet. They utilised every social engineering trick and invented quite a few of their own.”

The death knell for Storm really came in September 2007 when Microsoft started targeting Storm with its Malicious Software Removal Tool. In May 2008, Marshal said that Srizbi had overtaken Storm as the dominant spam botnet.

Marshal said that although Microsoft made the major contribution to the downfall of Storm, no one precisely knows what has happened to it - although some have suggested it has morphed into another botnet to produce spam.

Hay suggested that Storm was simply made obsolete in the face of more detection-resistant malware: “A distinct possibility is that the creators of Storm have abandoned it in favour of a newer botnet that they have created.

“If they have, it is possibly one of the top spam botnets that we continue to track. It seems unlikely that Storm’s creators simply gave up and went home.”

Email to a friend

Print this page