SYDNEY – Six botnets were responsible for 85 percent of all spam in February, the first time so few botnets have been responsible for so much spam, according to a British security product manufacturer.
The Threat Research and Content Engineering team (TRACE) of Marshal Ltd., which makes gateway and endpoint security products, made the analysis at the end of last month.
One botnet alone, dubbed Srizbi, was responsible for the largest amount of spam at 39 percent. It was followed by the Rustock botnet (20 percent) and the Mega-D botnet (11 percent) which returned with a vengeance after the discovery of its control servers saw its spam levels drop to zero during mid-February.
The 35,000 strong Mega-D botnet had returned to represent 21 percent of spam after a 10-day period of inactivity, said Bradley Anstis, vice-president of products for Marshal. “Owing to the break, Mega-D only accounted for an average of 11 percent of spam during February. At its peak last month, it was responsible for a third of all the spam we caught in our spam traps. While the recent publicity spooked the Mega-D spammers into taking their control servers offline, they have now clearly re-established themselves elsewhere,” Anstiss said.
According to TRACE, the Mega-D botnet is known for concentrating on male body part enhancement pills called “Megadik” or “VPXL” under brand names like “Express Herbals” and “Herbal King”.
Anstis said the Srizbi botnet is using advanced and extremely stealthy malware, garnering most of its success by using celebrity content to lure victims in.
But Srizbi and other sizeable botnets such as Rustock, Hacktool.Spammer and Pushdo are also pushing links to Web sites featuring “Express Herbals”.
“It appears the spammers behind this campaign have access to more than one botnet to distribute their messages. It’s also a possibility that one group controls more than one of these botnets,” Anstiss said.
“By highlighting these spam botnets, we hope the security industry can collectively target these major spamming sources and in doing so significantly reduce spam volumes.”
The Storm botnet, which attracted significant levels of publicity in recent months and was touted as the world’s largest botnet, accounted for only 2 percent of spam for the month of February.