IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

The Storm botnet is finally dead – but what's next?

The botnet which wrecked havoc in early 2007 is dead, but it looks like it has been replaced by something stronger.

The Storm botnet, which emerged in 2007 as one of the most disruptive pieces of malware, has faded away to nothing.

According to vendor Marshal, the spam coming from the botnet had been dwindling for months, finally stopping altogether this September.

The Storm botnet first really hit the headlines in January 2007, when it propagated to hit computer users in the UK, US and mainland Europe. Industry estimates for the number of computers infected at its peak ranged widely, but it was thought to be in between 500,000 and one million.

One weekend that January, it was particularly virulent as Storm embarked on unprecedented spamming campaigns for the time.

Between January and September 2007, the Storm tempest failed to die down, as it began to reinvent itself in different guises, a template for other spammers to develop their own botnets.

"Storm was one of the first botnets to use these tactics on a mass scale. It became the most successful botnet of its type and established the basic template for developing a spam empire that other botnets have since copied," said Phil Hay, lead threat analyst for Marshal TRACE.

He added: "They also led the way in using self-perpetuating malicious spam to grow the botnet. They utilised every social engineering trick and invented quite a few of their own."

The death knell for Storm really came in September 2007 when Microsoft started targeting Storm with its Malicious Software Removal Tool. In May 2008, Marshal said that Srizbi had overtaken Storm as the dominant spam botnet.

Marshal said that although Microsoft made the major contribution to the downfall of Storm, no one precisely knows what has happened to it - although some have suggested it has morphed into another botnet to produce spam.

Hay suggested that Storm was simply made obsolete in the face of more detection-resistant malware: "A distinct possibility is that the creators of Storm have abandoned it in favour of a newer botnet that they have created.

"If they have, it is possibly one of the top spam botnets that we continue to track. It seems unlikely that Storm's creators simply gave up and went home."

Featured Resources

The Total Economic Impact™ Of Turbonomic Application Resource Management for IBM Cloud® Paks

Business benefits and cost savings enabled by IBM Turbonomic Application Resource Management

Free Download

The Total Economic Impact™ of IBM Watson Assistant

Cost savings and business benefits enabled by Watson Assistant

Free Download

The field guide to application modernisation

Moving forward with your enterprise application portfolio

Free Download

AI for customer service

Discover the industry-leading AI platform that customers and employees want to use

Free Download

Recommended

Hackers could use new Wslink malware in highly targeted cyber attacks
malware

Hackers could use new Wslink malware in highly targeted cyber attacks

1 Nov 2021
FBI raids Chinese POS business following cyber attack claims
malware

FBI raids Chinese POS business following cyber attack claims

27 Oct 2021
Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021

Most Popular

Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
The benefits of a hardware update for SMBs
Sponsored

The benefits of a hardware update for SMBs

2 Aug 2022