Five botnets responsible for 75% of spam sent

Posted by   Virus Bulletin on   Jul 16, 2009

Each infected machine sends spam at rate of almost two messages per second.

Spam levels have increased 60% since the beginning of this year, according to security company Marshal8e6 in its latest Security Threats report. The increase means that spam levels are now back at where they were mid-2008, prior to the closure of the infamous McColo ISP.

In the report, Marshal8e6 also looks at the sources of spam, most of which is still sent via botnets made up of compromised computers. Just five botnets are responsible for around 75% of the spam sent, with the Rustock botnet alone being responsible for 45%. The Rustock botnet uses sophisticated techniques both to hide itself on the infected machine and to make the emails it sends looks legitimate: it uses HTML templates of genuine newsletters in which it inserts its own links and images, thus tricking both users and spam filters into believing the email is genuine.

The majority of spam still advertises pharmaceutical products, with Tamiflu and Acai Berry becoming prominent alongside Viagra and Cialis. The confidence of spammers in the stock markets seems to have decreased with the credit crunch, as only 0.1% of all spam messages are now pump-and-dump emails. The amount of spam containing malicious attachments is small compared to values seen in mid-2008, but still reaches peaks of 3% when botnets are running new malicious campaigns.

In the meantime, researchers at ESET looked at the relatively small Waledac botnet, which consists of at least 20,000 infected computers. They discovered that an infected machine is capable of sending more than 6,500 spam emails per hour - which is almost two per second. This gives this botnet a theoretical capacity of three billion spam emails per day; a number that is probably never reached, because not all infected machines will be online continuously.

The full Marshal8e6 Security Threats report can be downloaded here (PDF), while ESET's research is explained in a blog post here.

Posted on 16 July 2009 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

We are more ready for IPv6 email than we may think

Though IPv6 is gradually replacing IPv4 on the Internet's network layer, email is lagging behind, the difficulty in blocking spam sent over IPv6 cited as a reason not to move. But would we really have such a hard time blocking spam sent over IPv6?

Subtle change could see a reduction in installation of malicious Chrome extensions

Google has made a subtle change to its Chrome browser, banning the inline installation of new extensions, thus making it harder for malware authors to trick users into unwittingly installing malicious extensions.

Paper: EternalBlue: a prominent threat actor of 2017–2018

We publish a paper by researchers from Quick Heal Security Labs in India, who study the EternalBlue and DoublePulsar exploits in full detail.

'North Korea' a hot subject among VB2018 talks

Several VB2018 papers deal explicitly or implicitly with threats that have been attributed to North Korean actors.

Expired domain led to SpamCannibal's blacklist eating the whole world

The domain of the little-used SpamCannibal DNS blacklist had expired, resulting in it effectively listing every single IP address.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.