Spam Wars: Return of the Rustock

Stephen Withers
Wednesday, 26 November 2008 11:19

Business IT - Security

I hope you enjoyed the brief respite from spam that was observed following the takedown of McColo, because levels are rising again.

When hosting provider McColo was taken down on November 11, email filtering  operators noted a drop in spam of between two-thirds and three-quarters.

The provider was the home of the command and control servers used by major botnets that generate much of the world's spam.

Unfortunately, McColo was able to temporarily restore its connection to the Internet, giving the botnet operators an opportunity to transfer control of compromised PCs elsewhere. In the case of Rustock, that was to a data centre in Russia.

And now spam volumes are beginning to step up again.

According to Symantec and its MessageLabs subsidiary, spam levels have returned to two-thirds of what they were before the McColo takedown.

Similar levels have been detected by Sophos's spamtraps.

Matt Sergeant, MessageLabs' senior anti-spam technologist, said "The Asprox and Rustock botnets are back with a vengeance after having found new command and control."

Cutwail never went away and it seems its owners have used the opportunity to increase output, he added, and Mega-D is also on the rise again.

One piece of good news is that according to Sergeant, the Srizbi botnet  - once the source of 50 per cent of all spam - is now completely defunct, and without this botnet, spam levels won't return to what they had been.