SecureWorks: Storm worm may be for sale

Share this article:
The infamous storm worm trojan, which first hit inboxes in January, is poised to become a for-sale spam botnet system, complete with fast-flux DNS and hosting capabilities.

According to Joe Stewart, SecureWorks' senior security researcher, the storm worm is using a 40-byte key to encrypt traffic on the Overnet distributed-client peer-to-peer (p2p) network.

"This means that each node will be able to communicate only with nodes that use the same key," he said on SecureWorks' blog. "This effectively allows the storm author to segment the storm botnet into smaller networks [and] could be a precursor to selling storm to other spammers.

“If that's the case, we might see a lot more of storm in the future," he said.

Stewart also had some good news. Network administrators will be able to easily distinguish storm traffic from other p2p network use.

Once the storm worm compromises a PC, it adds it to its bot army. Spammers have customized their tactics to deliver the trojan in different ways, including electronic greeting cards and news stories.

In a July 16 outbreak, the storm worm generated 120 million messages, according to security vendor Postini, now a part of Google. The trojan was named for the European wind storms that occurred simultaneously with the first attacks this January.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.

Professor says Google search, not hacking, yielded medical info

Professor says Google search, not hacking, yielded medical ...

A professor of ethical hacking at City College San Francisco came forward to clarify that he did not demonstrate hacking a medical center's server in a class.

Syrian Malware Team makes use of enhanced BlackWorm RAT

Syrian Malware Team makes use of enhanced BlackWorm ...

FireEye analyzed the hacking group's use of the malware, dubbed the "Dark Edition" of BlackWorm.