Spam climbing back up after botnets return online

Share this article:
The amount of unwanted email is again surging after a host of botnets -- led by the high-powered Srizbi network of compromised machines -- have reconnected to internet service providers.

The volume of spam dropped dramatically over the past couple of weeks following the shutdown of a Silicon Valley-based web hosting provider, McColo.

As it turned out, McColo -- which appears to have ceased operating -- provided hosting capabilities for a number of unscrupulous cybergangs, some dedicated to the delivery of spam. After two internet service providers pulled the plug on McColo, the amount of spam fell by as much as 80 percent.

But it is climbing back after the botnets, such as Rustock, Mega-D and Srizbi, have re-established connectivity to their command-and-control centers, said Matt Sergeant, senior anti-spam technologist at MessageLabs, now owned by Symantec.

"When McColo went down, their command-and-control centers went away," Sergeant said. "What that means is the bots weren't getting any new work orders. Without new updates, eventually they just teeter out and die down."

The spammers have apparently been able to get back online thanks to an alternative plan, he said. Instead of relying on McColo's range of IP addresses to host their command-and-control centers, some of the bots contain an algorithm in the binary code that generates a unique domain name at which they can check for instructions.

"[The backup domain names] are automatically generated by the bots," Sergeant said. "The spammer then knows the algorithm used to generate that name and points that domain name at the new command-and-control center."

The Srizbi botnet, responsible for about half of all spam, regained its legs on Tuesday, according to a blog post from security firm FireEye.

"Srizbi has returned from the dead and has begun updating all its bots with a fresh, new binary," said the post. "The worldwide update began just a few hours ago. The new command-and-control servers are located in Estonia, and the domains registered through a registrar in Russia."

The level of spam jumped 112 percent on Tuesday, but still remains well off its highs of earlier in the month, according to IronPort

Sergeant said the drop in spam over the last two weeks soon will be a distant memory. But the spammers surely took a financial hit during that time.

"They have had to find new and presumably more expensive command-and-control hosting," he said. "And it's been basically two weeks without their spam-sending capabilities, so they've lost out on a lot of money there."


Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Florida Supreme Court rules warrants a must for real-time cell location tracking

Florida Supreme Court rules warrants a must for ...

The Florida Supreme Court put the kibosh on warrantless real-time tracking using location data obtained from cell phone providers.

Modular malware for OS X includes backdoor, keylogger components

Modular malware for OS X includes backdoor, keylogger ...

The modular malware was named "Ventir," by researchers at Kaspersky.

Fake Dropbox login page nabs credentials, is hosted on Dropbox

Fake Dropbox login page nabs credentials, is hosted ...

Symantec researchers received a phishing email linking recipients to a fake Dropbox login page that is hosted on Dropbox's user content domain and served over SSL.