IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Kroxxu botnet targets one million users

The Kroxxu botnet is believed to have affected over one million web users.


A new botnet has been detected which could have potentially affected over a million web users in the last 12 months.

The Kroxxu botnet currently has its grip on around 100,000 web domains and has been spreading password-stealing malware whilst covering its tracks extremely effectively, avast! Virus Lab found.

The surreptitious nature of the botnet meant researchers were unable to determine how the masterminds had monetised the operation.

"There are a number of ways they could be supporting themselves," said Jiri Sejtko, head of virus research at the avast! Virus Lab.

"The four most likely methods are through selling hacked space on infected servers, use of this malware to support the activities of other, more directly profitable malware, selling stolen credentials, or using keyloggers to spread other spam."

Kroxxu differs from traditional botnets, as its expansion has been achieved solely through infected websites.

It's owners gained passwords to take control of websites, before making alterations to the site's content in order to upload and modify files on infected servers, avast! explained.

The operators then spread the botnet to other servers across the world.

Kroxxu has used redirectors in order to make it difficult to track the botnet's activities. The security company estimated over 10,000 redirectors had been employed by Kroxxu over the last year.

The malicious network also used alterable components, as each layer of the botnet performs a specific task, giving it greater flexibility.

"Kroxxu's indirect cross infections are based on the fact that all parts [are] equal and interchangeable," explained Sejtko.

"If one part is used as an initial redirector, it may also be used as a final distribution part at the same or even a different time. This gives it an enormous range of designed-in duplicity."

Kroxxu could spread to gain much more traction, avast! said. URL blocking engines may struggle to differentiate between standard malware distribution domains run by the malware authors and hacked zombie domains like those controlled by Kroxxu, the security firm explained.

There have been a number of successful botnet takedowns this year, which led to a drop in spam in the last quarter.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

The state of brand protection 2021

A new front opens up in the war for brand safety

Free download

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022
Attracting and retaining talent through training

Attracting and retaining talent through training

13 Jun 2022