Botnet creators return with Bredolab trojan
The authors of the Cutwail botnet are fighting back to get more market share.

This month has seen a large surge in spam carrying a trojan called Bredolab, with a security researcher suggesting this was due to cyber criminals trying to regrow the Cutwail botnet.
Paul Wood, a senior analyst at Symantec, said that Bredolab has existed since April and May in relatively small numbers, but its use had dramatically grown in the last month.
Bredolab is a downloader used to "drop" malware on machines and could be used to infect computers to add to the Cutwail botnet.
It was found in attachments coming from spam mail sent by computers under the Cutwail botnet, which has seen its own numbers decrease in the past year due to ISP shutdowns.
The Cutwail botnet decreased from sending around 45 per cent of spam at the beginning of the year to only 11 per cent in September.
Wood said this could mean that the Cutwail malware authors were trying to respread Cutwail to make up for its losses.
"Cutwail is one of those botnets earlier [that] in the year was very large, but it's been overtaken by a number of other botnets," he said.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"There's definitely some activity to try and increase its coverage," he added.
-
Bigger salaries, more burnout: Is the CISO role in crisis?
In-depth CISOs are more stressed than ever before – but why is this and what can be done?
By Kate O'Flaherty Published
-
Cheap cyber crime kits can be bought on the dark web for less than $25
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott Published
-
Seized database helps Europol snare botnet customers in ‘Operation Endgame’ follow-up sting
News Europol has detained several people believed to be involved in a botnet operation as part of a follow-up to a major takedown last year.
By Emma Woollacott Published
-
Horabot campaign targeted businesses for more than two years before finally being discovered
News The newly-discovered Horabot botnet has attacked companies in the accounting, investment, and construction sectors in particular
By Ross Kelly Published
-
Brand-new Emotet campaign socially engineers its way from detection
News This latest resurgence follows a three-month hiatus and tricks users into re-enabling dangerous VBA macros
By Ross Kelly Published
-
Microsoft says “it’s just too difficult” to effectively disrupt ransomware
News The company details its new approach to combatting cyber crime as the underground industry drains $6 trillion from the global economy
By Connor Jones Published
-
Beating the bad bots: Six ways to identify and block spam traffic
In-depth Not all traffic is good. Learn how to prevent bad bots from overrunning your website
By Sead Fadilpašić Published
-
Ukraine's vigilante IT army now has a DDoS bot to automate attacks against Russia
News The 270,000-strong IT Army of Ukraine will now combine supporters' cloud infrastructure to strengthen the daily attacks against their invaders
By Connor Jones Published
-
Microsoft's secure VBA macro rules already being bypassed by hackers
News Recent analysis of Emotet activity has revealed a shift away from malicious Office documents to drop malware
By Connor Jones Published
-
CronRat Magecart malware uses 31st February date to remain undetected
News The malware allows for server-side payment skimming that bypasses browser security
By Rene Millman Published