Bagle to succeed Rustock as spam king?

There may be a new botnet spamming king in town in the form of Bagle.


A botnet known as Bagle could replace the once dominant spam king Rustock, even though the recent takedown had a significant impact on junk mail levels.

Spam volumes dropped by 33.6 per cent between 15 and 17 March, according to MessageLabs Intelligence. The decrease came after Rustock was successfully taken out thanks to a collaborative effort led by Microsoft.

In the following days, spam accounted for around 33 billion emails a day, compared to an average of 52 billion in the previous week.

However, other botnets have upped their game, with Bagle usurping Rustock as the most active spamming botnet of 2011.

Bagle wasn't even in the top 10 spam-sending botnets at the end of 2010, but is now pushing out around 8.31 billion emails a day most of which have been linked to pharmaceutical products.

Rustock was a notorious pharmaceutical spammer as well.

Paul Wood, MessageLabs Intelligence senior analyst at, said Bagle has been more consistent in sending out spam than Rustock.

"What happened with Rustock was that every two to three days it would send out a massive burst of spam and then would go quiet," he told IT PRO.

"The amount of spam now coming from Bagle is consistent every day. Even though it doesn't have as many bots under its control as a botnet like Rustock, it's actually able to send more spam because of that consistency."

Rustock may not be gone for good either, according to Wood, as the botnet has some backup redundancy in its command and control channels.

Wood also indicated a "Son of Rustock" could emerge from the ashes of the apparently deceased botnet.

"We did see that when McColo was taken down, when there was a botnet called Srizbi, which accounted then for about 50 per cent of all spam," Wood added.

"[After the McColo takedown] it was a matter of months before spam levels returned to previous volumes. We were then seeing other botnets picking up the slack. That might be what we're seeing with Bagle because there is demand there from spammers and affiliates, particularly they want to be able to send this stuff anonymously."

IT PRO recently spoke to FireEye senior security researcher Alex Lanstein, who worked with Microsoft on the Rustock takedown.

He suggested the perpetrators may give up on Rustock given the amount of money they would have made from the operation and the fact they face being hunted by law enforcement bodies.

Featured Resources

2021 Thales access management index: Global edition

The challenges of trusted access in a cloud-first world

Free download

Transforming higher education for the digital era

The future is yours

Free download

Building a cloud-native, hybrid-multi cloud infrastructure

Get ready for hybrid-multi cloud databases, AI, and machine learning workloads

Free download

The next biggest shopping destination is the cloud

Know why retail businesses must move to the cloud

Free Download

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021