Spam is nearly back to business as usual, reaching up to 90 percent of pre McColo Corp. takedown levels. After a couple of months, botnets have found new bases of operation and are expanding at alarming rates.
The bad news comes courtesy of Semantec’s MessageLabs, whose January 2009 Intelligence Report reveals spam levels reached 74.6 percent of all email in December, nearing the spam saturation prior to McColo’s demise in November, which dropped the total amount of spam by up to 75 percent instantly.
Security experts then warned it would only be a temporary reprieve as spammers regrouped in a less centralized (read: more difficult to track) operation. MessageLabs puts the spotlight on botnets, three in particular, as the biggest spam threats in 2009: Mega-D (Ozdoc), Cutwail (Pandex), and Waledac.
“The potential of these botnets to spam in large volumes is a major concern,” said Paul Wood, MessageLabs Intelligence Analyst, Symantec. “In particular, Waledac is believed to be the next generation of the infamous botnet Storm (Peacomm).
“Whilst Waledac malware was spread at an alarming rate in January, it was dispersing spam in relatively small volumes. For now, the botnet controllers are clearly focusing on growing and developing this new botnet resource rather than using it to spam. It will be one to watch as 2009 progresses.”
Post-McColo, a former spam champ botnet, Srizbi met its demise. However, Mega-D is thought to be the prime successor, sending around an average of 26 million spam emails per minute. Each PC infected by Mega-D sends out over 589,000 emails daily.
One disturbing aspect of Mega-D/Ozdoc(k), comprising of 120,000 bots, is an invasive new function that collects screenshots of infected computers and sends them to a control server, according to Joe Stewart at SecureWorks. Stewart believes this is a scanning function allowing spammers to identify computers of interest to further probe for financial information or even intellectual property.
Though this isn’t a new tactic for backdoor Trojans, it is new to the spambot world.
MessageLabs identified Cutwail as one of the key botnets to watch in 2009. The largest botnet of them all, it’s (fortunately) not living up to its potential. Increasing the botnet’s throughput would considerably increase the amount of spam sent from five million per minute.
Waledac is new and is not in the top ten but is getting a lot of attention from security researchers because of its Storm worm legacy status. It has been spreading at an “alarming” rate in Janurary, but infected machines aren’t putting out “a great volume” of spam. Though Skeptic has intercepted 25,000 emails daily from Waledac in the first two weeks of January, this botnet is thought to still be under development.
