Security Market Segment LS
Sunday, 10 April 2016 10:51

Massive Linux botnet finally taken down Featured


A botnet that has been sending out spam from a network of around 4000 Linux servers for many years has finally been put out of operation, according to the security firm ESET.

The servers were infected with malware known as Mumblehard which ESET researchers discovered and issued details about a year ago.

In a blog post, ESET said it had taken down the botnet in co-operation with the Cyber Police of Ukraine and Cys Centrum LLC on February 29.

The company is now operating a sinkhole for Mumblehard components and sharing the data with the Computer Emergency Readiness Team in Germany which is notifying affected parties through their national CERTs.

After the initial analysis was published last year, ESET said it noticed that the operators of the botnet had taken down all the command and control servers, apart from one that was directly under their control.

With only one IP address in play, ESET decided to notify the authorities in the country of operation and take over the IP address. Analysing information obtained from the command and control server in October last year, ESET researchers were able to determine that the various bots had been infected using vulnerabilities in PHP.

Unpatched versions of WordPress or Joomla! or plugins for these content management systems had also served as pathways for infection.

The researchers also discovered that there was code in the command and control server that requested automatic delisting whenever one of the bots got listed in the Spamhaus Composite Blocking list. This is a list that serves to block servers that are sending out spam.

There were victims in 63 countries, ESET reported. The command and control server was shut down on February 29 by Ukrainian authorities and replaced with a server under the control of ESET. Data collected throughout March showed that at least 4000 Linux systems had been compromised.

According to the researchers, Mumblehard had been active since at least 2009. Other findings were that the Perl scripts used were packed inside ELF binaries written in assembly language, showing a higher level of sophistication than is usual among the creators of similar malware.

A total of 8867 unique IP addresses were seen in the ESET sinkhole over a seven-month period, with the highest number of unique IP addresses in a day being 3292.

The research also found that web servers were the most susceptible to being infected and that there was a link between Mumblehard and Yellsoft, an online company selling software for sending bulk email messages.


You cannot afford to miss this Dell Webinar.

With Windows 7 support ending 14th January 2020, its time to start looking at your options.

This can have significant impacts on your organisation but also presents organisations with an opportunity to fundamentally rethink the way users work.

The Details

When: Thursday, September 26, 2019
Presenter: Dell Technologies
Location: Your Computer


QLD, VIC, NSW, ACT & TAS: 11:00 am
SA, NT: 10:30 am
WA: 9:00 am NZ: 1:00 pm

Register and find out all the details you need to know below.



iTWire can help you promote your company, services, and products.


Advertise on the iTWire News Site / Website

Advertise in the iTWire UPDATE / Newsletter

Promote your message via iTWire Sponsored Content/News

Guest Opinion for Home Page exposure

Contact Andrew on 0412 390 000 or email [email protected]


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments