Szirbi botnet causes spam to triple in a week

Share this article:

Malicious spam has tripled in volume in a week, most of it caused by the Srizbi botnet, according to research by the Marshal TRACE team. 

When June began, three percent of total spam was malware, but by the following week, that amount jumped to 9.9 percent. Malcious spam usually contains a URL linking to a malware-serving website.

Since February, Srizbi has been responsible for nearly half of all spam, overtaking the previous record holder — the Storm botnet.

Glen Myers, an engineer with Marshal, attributed the increase to one of two things:

“Either it is a mistake and the bad guys are cranking out more malicious spam than they meant to,” Myers told SCMagazineUS.com on Wednesday, “or this is a push to take over more of the market. The more machines they have, the more money they can make."

Srizbi is a pernicious botnet, not just due to its size, but also because it implements an extremely fast mail-sending engine, Matt Sergeant, senior anti-spam technologist at messaging security vendor MessageLabs, told SCMagazineUS.com.

“Those who have worked in IT for some time will remember when Microsoft moved the graphics engine for Windows into the kernel in NT4 in order to improve performance,” he said. “That's what the botnet authors have done with Srizbi in order to be able to send mail faster -- moved the engine into the Windows kernel. This allows it to send more mail per hour than a regular botnet.”

Most of the recent malicious spam is capitalizing on two popular ways of social networking. One is to spoof the Classmates.com site by sending messages saying there is an update on friend information. The other is to send a video link with a message stating, “Here's a link of you doing something stupid.”

Myers said efforts to bring down Srizbi will be challenging.

“The botnet is very good at keeping out of sight,” he said. “It changes frequently, making it more difficult to detect with malware scanners.”

Share this article:

Sign up to our newsletters

More in News

AOL Mail hack furthers spam campaign using spoofed accounts

AOL confirmed on Monday that it was aware of the issue and working to remediate the situation.

Backdoors in Wi-Fi routers, said to be closed, can be reopened

Backdoors in Wi-Fi routers, said to be closed, ...

Although said to be patched, researcher Eloi Vanderbeken discovered during the Easter holiday that backdoors existing in certain wireless routers can be reactivated.

Apple ships Mac OS X updates, fixes several code execution bugs

Apple ships Mac OS X updates, fixes several ...

Among the addressed vulnerabilities, was a bug affecting WindowServer, which could allow an attacker to execute malicious code outside the sandbox.