Five botnets responsible for 75% of spam sent

Posted by   Virus Bulletin on   Jul 16, 2009

Each infected machine sends spam at rate of almost two messages per second.

Spam levels have increased 60% since the beginning of this year, according to security company Marshal8e6 in its latest Security Threats report. The increase means that spam levels are now back at where they were mid-2008, prior to the closure of the infamous McColo ISP.

In the report, Marshal8e6 also looks at the sources of spam, most of which is still sent via botnets made up of compromised computers. Just five botnets are responsible for around 75% of the spam sent, with the Rustock botnet alone being responsible for 45%. The Rustock botnet uses sophisticated techniques both to hide itself on the infected machine and to make the emails it sends looks legitimate: it uses HTML templates of genuine newsletters in which it inserts its own links and images, thus tricking both users and spam filters into believing the email is genuine.

The majority of spam still advertises pharmaceutical products, with Tamiflu and Acai Berry becoming prominent alongside Viagra and Cialis. The confidence of spammers in the stock markets seems to have decreased with the credit crunch, as only 0.1% of all spam messages are now pump-and-dump emails. The amount of spam containing malicious attachments is small compared to values seen in mid-2008, but still reaches peaks of 3% when botnets are running new malicious campaigns.

In the meantime, researchers at ESET looked at the relatively small Waledac botnet, which consists of at least 20,000 infected computers. They discovered that an infected machine is capable of sending more than 6,500 spam emails per hour - which is almost two per second. This gives this botnet a theoretical capacity of three billion spam emails per day; a number that is probably never reached, because not all infected machines will be online continuously.

The full Marshal8e6 Security Threats report can be downloaded here (PDF), while ESET's research is explained in a blog post here.

Posted on 16 July 2009 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

VB2018 preview: hacking cars

In recent years, car hacking has evolved from a mostly theoretical research field involving giggling researchers and scared journalists, to one that actually concerns car owners and manufacturers. On today's blog we preview two VB2018 papers, by…

Where are all the ‘A’s in APT?

In a guest blog post by VB2018 gold partner Kaspersky Lab, Costin Raiu, Director of the company's Global Research and Analysis Team, looks critically at the 'A' in APT.

VB2018 preview: commercial spyware and its use by governments

Today, we preview three VB2018 presentations that look at threats against civil society in general and the use of commercial spyware by governments for this purpose in particular.

VB2018 preview: Wipers in the wild

Today we preview the VB2018 paper by Saher Naumaan (BAE Systems Applied Intelligence) on the use of wipers in APT attacks.

VB2018 preview: IoT botnets

The VB2018 programme is packed with a wide range of security topics featuring speakers from all around the world. Today we preview two of them: one by Qihoo 360 researchers on tracking variants of Mirai and one by researchers from Bitdefender on the…

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.