Tuesday, July 24, 2012

Global Botnet Summary Report

Above taken after Grup Spam Botnet taken down by FireEye,

 The world's third-largest spam-generating network was knocked offline on Wednesday, according to a security researcher who was directly involved with the takedown of the once formidable Grum botnet's infrastructure in three countries.

Until this week, Grum's servers based in Russia, Panama, and the Netherlands were estimated to control at least 100,000 infected "zombie" PCs, or bots, responsible for as much as 18 per cent of the world's spam. Immediately before the takedown, Grum ranked behind only the Cutwail and Lethic spam botnets in size, though as recently as January of this year Grum was considered the world's most active spam generator.

FireEye, working with Russian CERT-GIB and Spamhaus, found each of these new CnC servers, took a heavy-handed approach in working with Russian ISPs and domain registrars, and took them down as of 11am PT this morning, signaling the full shut down of the botnet.

According to data coming from Spamhaus, on average, they used to see around 120,000 Grum IP addresses sending spam each day, but after the takedown, this number has been reduced to 21,505. I hope that once the spam templates expire, the rest of the spam with fade away as well.

Botnet are collections of compromised hosts that attackers remotely control for their own nefarious purposes.
Once installed and running, a malicious bot will attempt to connect to a remote server to receive instructions on what actions to take. The most common command and control (C&C) protocol used for this is Internet Relay Chat (IRC). While a legitimate protocol for online chat, IRC is often used by attackers due to the relative simplicity of the protocol along with the ready availability of bot software written to use it. After connecting, a bot-controlled host can be controlled by an attacker and commanded to conduct malicious actions such as sending spam, scanning the Internet for other potentially controllable hosts, or launching DoS attacks.
Posted by at
Labels:

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)