A botnet known as Bagle could replace the once dominant spam king Rustock, even though the recent takedown had a significant impact on junk mail levels.
Spam volumes dropped by 33.6 per cent between 15 and 17 March, according to MessageLabs Intelligence. The decrease came after Rustock was successfully taken out thanks to a collaborative effort led by Microsoft.
In the following days, spam accounted for around 33 billion emails a day, compared to an average of 52 billion in the previous week.
However, other botnets have upped their game, with Bagle usurping Rustock as the most active spamming botnet of 2011.
Bagle wasn't even in the top 10 spam-sending botnets at the end of 2010, but is now pushing out around 8.31 billion emails a day most of which have been linked to pharmaceutical products.
Rustock was a notorious pharmaceutical spammer as well.
Paul Wood, MessageLabs Intelligence senior analyst at Symantec.cloud, said Bagle has been more consistent in sending out spam than Rustock.
"What happened with Rustock was that every two to three days it would send out a massive burst of spam and then would go quiet," he told IT PRO.
"The amount of spam now coming from Bagle is consistent every day. Even though it doesn't have as many bots under its control as a botnet like Rustock, it's actually able to send more spam because of that consistency."
Rustock may not be gone for good either, according to Wood, as the botnet has some backup redundancy in its command and control channels.
Wood also indicated a "Son of Rustock" could emerge from the ashes of the apparently deceased botnet.
"We did see that when McColo was taken down, when there was a botnet called Srizbi, which accounted then for about 50 per cent of all spam," Wood added.
"[After the McColo takedown] it was a matter of months before spam levels returned to previous volumes. We were then seeing other botnets picking up the slack. That might be what we're seeing with Bagle because there is demand there from spammers and affiliates, particularly they want to be able to send this stuff anonymously."
IT PRO recently spoke to FireEye senior security researcher Alex Lanstein, who worked with Microsoft on the Rustock takedown.
He suggested the perpetrators may give up on Rustock given the amount of money they would have made from the operation and the fact they face being hunted by law enforcement bodies.
-
Seized database helps Europol snare botnet customers in ‘Operation Endgame’ follow-up stingNews Europol has detained several people believed to be involved in a botnet operation as part of a follow-up to a major takedown last year.
-
Horabot campaign targeted businesses for more than two years before finally being discoveredNews The newly-discovered Horabot botnet has attacked companies in the accounting, investment, and construction sectors in particular
-
Brand-new Emotet campaign socially engineers its way from detectionNews This latest resurgence follows a three-month hiatus and tricks users into re-enabling dangerous VBA macros
-
Microsoft says “it’s just too difficult” to effectively disrupt ransomwareNews The company details its new approach to combatting cyber crime as the underground industry drains $6 trillion from the global economy
-
Beating the bad bots: Six ways to identify and block spam trafficIn-depth Not all traffic is good. Learn how to prevent bad bots from overrunning your website
-
Ukraine's vigilante IT army now has a DDoS bot to automate attacks against RussiaNews The 270,000-strong IT Army of Ukraine will now combine supporters' cloud infrastructure to strengthen the daily attacks against their invaders
-
Microsoft's secure VBA macro rules already being bypassed by hackersNews Recent analysis of Emotet activity has revealed a shift away from malicious Office documents to drop malware
-
Emotet infrastructure has almost doubled since resurgence was confirmed
News Researchers confirm the infrastructure has also been upgraded for a "better secured", more resilient operation
