Szirbi botnet causes spam to triple in a week

Share this article:

Malicious spam has tripled in volume in a week, most of it caused by the Srizbi botnet, according to research by the Marshal TRACE team. 

When June began, three percent of total spam was malware, but by the following week, that amount jumped to 9.9 percent. Malcious spam usually contains a URL linking to a malware-serving website.

Since February, Srizbi has been responsible for nearly half of all spam, overtaking the previous record holder — the Storm botnet.

Glen Myers, an engineer with Marshal, attributed the increase to one of two things:

“Either it is a mistake and the bad guys are cranking out more malicious spam than they meant to,” Myers told SCMagazineUS.com on Wednesday, “or this is a push to take over more of the market. The more machines they have, the more money they can make."

Srizbi is a pernicious botnet, not just due to its size, but also because it implements an extremely fast mail-sending engine, Matt Sergeant, senior anti-spam technologist at messaging security vendor MessageLabs, told SCMagazineUS.com.

“Those who have worked in IT for some time will remember when Microsoft moved the graphics engine for Windows into the kernel in NT4 in order to improve performance,” he said. “That's what the botnet authors have done with Srizbi in order to be able to send mail faster -- moved the engine into the Windows kernel. This allows it to send more mail per hour than a regular botnet.”

Most of the recent malicious spam is capitalizing on two popular ways of social networking. One is to spoof the Classmates.com site by sending messages saying there is an update on friend information. The other is to send a video link with a message stating, “Here's a link of you doing something stupid.”

Myers said efforts to bring down Srizbi will be challenging.

“The botnet is very good at keeping out of sight,” he said. “It changes frequently, making it more difficult to detect with malware scanners.”

Share this article:

Sign up to our newsletters

More in News

Feds warn health care sector of looming cyber attacks

The FBI believes that the lax security systems that the health care industry has in place make it a prime target for cyber attacks.

Brazilian president signs internet 'Bill of Rights' into law

Brazilian president signs internet 'Bill of Rights' into ...

President Dilma Rousseff signed the legislation on Wednesday at the NetMundial conference in Sao Paulo.

Android trojan sends premium SMS messages, targets U.S. users for first time

Android trojan sends premium SMS messages, targets U.S. ...

An SMS trojan for Android, known as FakeInst, has been observed sending premium SMS messages to users all over the world, including, for the first time, the United States.