Five botnets responsible for 75% of spam sent

Posted by   Virus Bulletin on   Jul 16, 2009

Each infected machine sends spam at rate of almost two messages per second.

Spam levels have increased 60% since the beginning of this year, according to security company Marshal8e6 in its latest Security Threats report. The increase means that spam levels are now back at where they were mid-2008, prior to the closure of the infamous McColo ISP.

In the report, Marshal8e6 also looks at the sources of spam, most of which is still sent via botnets made up of compromised computers. Just five botnets are responsible for around 75% of the spam sent, with the Rustock botnet alone being responsible for 45%. The Rustock botnet uses sophisticated techniques both to hide itself on the infected machine and to make the emails it sends looks legitimate: it uses HTML templates of genuine newsletters in which it inserts its own links and images, thus tricking both users and spam filters into believing the email is genuine.

The majority of spam still advertises pharmaceutical products, with Tamiflu and Acai Berry becoming prominent alongside Viagra and Cialis. The confidence of spammers in the stock markets seems to have decreased with the credit crunch, as only 0.1% of all spam messages are now pump-and-dump emails. The amount of spam containing malicious attachments is small compared to values seen in mid-2008, but still reaches peaks of 3% when botnets are running new malicious campaigns.

In the meantime, researchers at ESET looked at the relatively small Waledac botnet, which consists of at least 20,000 infected computers. They discovered that an infected machine is capable of sending more than 6,500 spam emails per hour - which is almost two per second. This gives this botnet a theoretical capacity of three billion spam emails per day; a number that is probably never reached, because not all infected machines will be online continuously.

The full Marshal8e6 Security Threats report can be downloaded here (PDF), while ESET's research is explained in a blog post here.

Posted on 16 July 2009 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Alleged author of creepy FruitFly macOS malware arrested

A 28-year old man from Ohio has been arrested on suspicion of having created the mysterious FruitFly malware that targeted macOS and used it to spy on its victims.

The threat and security product landscape in 2017

At the start of the new year, Virus Bulletin looks back at the threats seen in the 2017 and at the security products that are available to help mitigate them.

Spamhaus report shows many botnet controllers look a lot like legitimate servers

Spamhaus's annual report on botnet activity shows that botherders tend to use popular, legitimate hosting providers, domain registrars and top-level domains when setting up command-and-control servers.

Tips on researching tech support scams

As tech support scammers continue to target the computer illiterate through cold calling, VB's Martijn Grooten uses his own experience to share some advice on how to investigate such scams.

Meltdown and Spectre attacks mitigated by operating system updates

Just four days into the new year, two serious attacks in modern processors, dubbed Meltdown and Spectre, have been discovered. The attacks can be mitigated by patches to the operating system, but anti-virus software vendors need to make sure their…