Five botnets responsible for 75% of spam sent

Posted by   Virus Bulletin on   Jul 16, 2009

Each infected machine sends spam at rate of almost two messages per second.

Spam levels have increased 60% since the beginning of this year, according to security company Marshal8e6 in its latest Security Threats report. The increase means that spam levels are now back at where they were mid-2008, prior to the closure of the infamous McColo ISP.

In the report, Marshal8e6 also looks at the sources of spam, most of which is still sent via botnets made up of compromised computers. Just five botnets are responsible for around 75% of the spam sent, with the Rustock botnet alone being responsible for 45%. The Rustock botnet uses sophisticated techniques both to hide itself on the infected machine and to make the emails it sends looks legitimate: it uses HTML templates of genuine newsletters in which it inserts its own links and images, thus tricking both users and spam filters into believing the email is genuine.

The majority of spam still advertises pharmaceutical products, with Tamiflu and Acai Berry becoming prominent alongside Viagra and Cialis. The confidence of spammers in the stock markets seems to have decreased with the credit crunch, as only 0.1% of all spam messages are now pump-and-dump emails. The amount of spam containing malicious attachments is small compared to values seen in mid-2008, but still reaches peaks of 3% when botnets are running new malicious campaigns.

In the meantime, researchers at ESET looked at the relatively small Waledac botnet, which consists of at least 20,000 infected computers. They discovered that an infected machine is capable of sending more than 6,500 spam emails per hour - which is almost two per second. This gives this botnet a theoretical capacity of three billion spam emails per day; a number that is probably never reached, because not all infected machines will be online continuously.

The full Marshal8e6 Security Threats report can be downloaded here (PDF), while ESET's research is explained in a blog post here.

Posted on 16 July 2009 by Virus Bulletin

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2018 paper and video: Android app deobfuscation using static-dynamic cooperation

Static analysis and dynamic analysis each have their shortcomings as methods for analysing potentially malicious files. Today, we publish a VB2018 paper by Check Point researchers Yoni Moses and Yaniv Mordekhay, in which they describe a method that…

VB2019 call for papers closes this weekend

The call for papers for VB2019 closes on 17 March, and while we've already received many great submissions, we still want more!

Registration open for VB2019 ─ book your ticket now!

Registration for VB2019, the 29th Virus Bulletin International Conference, is now open, with an early bird rate available until 1 July.

The VB2019 call for papers is about ... papers

When we are calling for papers for the Virus Bulletin conference as we are doing now, we really mean a written paper. But don't worry if you've never written a paper - we can help!

VB2018 video: Adware is just malware with a legal department - how we reverse engineered OSX/Pirrit, received legal threats, and survived

Amit Serper first analysed the OSX/Pirrit adware in 2016, highlighting some of its malware-like techniques, and soon afterwards started receiving legal threats from the company behind it. At VB2018 Amit gave a presentation in which he discussed both…

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.