Security Market Segment LS
Sunday, 10 April 2016 10:51

Massive Linux botnet finally taken down Featured


A botnet that has been sending out spam from a network of around 4000 Linux servers for many years has finally been put out of operation, according to the security firm ESET.

The servers were infected with malware known as Mumblehard which ESET researchers discovered and issued details about a year ago.

In a blog post, ESET said it had taken down the botnet in co-operation with the Cyber Police of Ukraine and Cys Centrum LLC on February 29.

The company is now operating a sinkhole for Mumblehard components and sharing the data with the Computer Emergency Readiness Team in Germany which is notifying affected parties through their national CERTs.

After the initial analysis was published last year, ESET said it noticed that the operators of the botnet had taken down all the command and control servers, apart from one that was directly under their control.

With only one IP address in play, ESET decided to notify the authorities in the country of operation and take over the IP address. Analysing information obtained from the command and control server in October last year, ESET researchers were able to determine that the various bots had been infected using vulnerabilities in PHP.

Unpatched versions of WordPress or Joomla! or plugins for these content management systems had also served as pathways for infection.

The researchers also discovered that there was code in the command and control server that requested automatic delisting whenever one of the bots got listed in the Spamhaus Composite Blocking list. This is a list that serves to block servers that are sending out spam.

There were victims in 63 countries, ESET reported. The command and control server was shut down on February 29 by Ukrainian authorities and replaced with a server under the control of ESET. Data collected throughout March showed that at least 4000 Linux systems had been compromised.

According to the researchers, Mumblehard had been active since at least 2009. Other findings were that the Perl scripts used were packed inside ELF binaries written in assembly language, showing a higher level of sophistication than is usual among the creators of similar malware.

A total of 8867 unique IP addresses were seen in the ESET sinkhole over a seven-month period, with the highest number of unique IP addresses in a day being 3292.

The research also found that web servers were the most susceptible to being infected and that there was a link between Mumblehard and Yellsoft, an online company selling software for sending bulk email messages.


As part of our Lead Machine Methodology we will help you get more leads, more customers and more business. Let us help you develop your digital marketing campaign

Digital Marketing is ideal in these tough times and it can replace face to face marketing with person to person marketing via the phone conference calls and webinars

Significant opportunity pipelines can be developed and continually topped up with the help of Digital Marketing so that deals can be made and deals can be closed

- Newsletter adverts in dynamic GIF slideshow formats

- News site adverts from small to large sizes also as dynamic GIF slideshow formats

- Guest Editorial - get your message out there and put your CEO in the spotlight

- Promotional News and Content - displayed on the homepage and all pages

- Leverage our proven event promotion methodology - The Lead Machine gets you leads

Contact Andrew our digital campaign designer on 0412 390 000 or via email



Security requirements such as confidentiality, integrity and authentication have become mandatory in most industries.

Data encryption methods previously used only by military and intelligence services have become common practice in all data transfer networks across all platforms, in all industries where information is sensitive and vital (financial and government institutions, critical infrastructure, data centres, and service providers).

Get the full details on Layer-1 encryption solutions straight from PacketLight’s optical networks experts.

This white paper titled, “When 1% of the Light Equals 100% of the Information” is a must read for anyone within the fiber optics, cybersecurity or related industry sectors.

To access click Download here.


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments