41% of spam sent via Rustock botnet

Posted by   Virus Bulletin on   Aug 26, 2010

Botnet spam back after short summer break.

In its latest intelligence report, security firm MessageLabs reports that 41% of all spam is being sent through the Rustock botnet, an increase of 9% since April. The botnet sends an estimated 32 million spam emails per minute.

Interestingly, the number of bots controlled by Rustock's botherders has almost halved in the same period. One of the reasons for this apparent contradiction appears to be the drop in the use of TLS for sending the spam.

TLS makes use of an encrypted connection to send the messages and botherders may have believed this would decrease the chances of their messages being intercepted; in April, 30% of all spam and 70% of Rustock spam was send using TLS. However, TLS significantly slows down the connection, and with now less than 0.2% of spam being sent over TLS connections, spammers seem to have realised that their delivery rates were being significantly impacted by its use.

Currently 92.2% of all email is spam - an increase of 3.3% since July; 95% of these spam messages are sent via botnets. The relatively low spam ratio in July is explained by a temporary drop in spam coming from a number of botnets, most notable the Grum botnet.

In August, Grum's output increased again and it now takes up second position among the most prolific spamming botnets, with over 16% of spam sent through its bots. While Rustock has mostly infected computers in Western countries, Grum's bots are more likely to be found in Russia, India and Vietnam.

The full MessageLabs report can be found here (PDF), with comments on how this affects those sending legitimate email at the Word to the Wise blog here.

Posted on 26 August 2010 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

More on the Moose botnet at Botconf

At Botconf 2016 this week, GoSecure researchers Masarah Paquet-Clouston and Olivier Bilodeau presented their research on the Moose botnet - something Olivier Bilodeau previously spoke about at VB2015.

VB2016 paper: Defeating sandbox evasion: how to increase successful emulation rate in your virtualized environment

Today, we publish the VB2016 paper and presentation (recording) by Check Point Software researchers Alexander Chailytko and Stanislav Skuratovich, which focuses on the techniques used by malware to detect virtual environments, and provides detailed…

VB2016 paper: Mobile applications: a backdoor into the Internet of Things?

While the Internet of Things blossoms with newly connected objects every day, the security and privacy of these objects is often overlooked, making the IoT a major security concern. Unfortunately, reverse-engineering so-called smart devices is not an…

VB2016 paper: Wave your false flags! Deception tactics muddying attribution in targeted attacks

Today, we publish the VB2016 paper and presentation (recording) by Kaspersky Lab researchers Juan Andrés Guerrero-Saade and Brian Bartholomew, in which they look at some of the deception tactics used in targeted attacks.

Throwback Thursday: The Politics of Anti-Virus

President-elect of the United States Donald Trump made a number of promises about cybersecurity during his electoral campaign. What comes of those pledges remains to be seen, but one thing is certain: there will be a team of hard-working, dedicated…