Feeds

Storm worm botnet turns into April shower

Shrinking away

Providing a secure and efficient Helpdesk

The Storm worm botnet shrank in April to just five per cent of its original size, according to MessageLabs, which conducts a monthly analysis of malware trends.

New tools that remove Storm infections are responsible for the huge fall in Storm-infected machines, the net security firm says. By the end of Aprl the Storm Worm botnet had about 100,000 compromised computers, compared with two million zombie machines in March. The decline is also evident in the 57 per cent slump in malware-laden emails the Storm botnet distributed in April.

While the Storm botnet shrank, analysis of web-based malware identified that 36.1 per cent of interceptions in April were new, up 25 per cent on March. MessageLabs also identified an average of 1,214 new websites per day harboring malware and other potentially unwanted programs such as spyware and adware. This is an increase of 619 per day compared with the previous month.

In the week of 30th anniversary of the first spam message, MessageLabs identified a new spamming technique being used to send authenticated spam email via Yahoo!’s SMTP servers. This spam attack accounts for one percent of all spam intercepted in April and has been used to advertise services for Canadian Pharmacy, a well-known spam operation. By using the SMTP server and a DomainKeys Identified Mail (DKIM) authentication technique, the spammers can ensure that the email generated is more likely to get past conventional anti-spam filters.

Targeted Trojans hit record daily levels last month. MessageLabs intercepting approximately 70 targeted Trojans per day, compared to 28 per day in December 2007.

Scammers as well as malware authors are adopting their tactics. 419 advanced fee fraudsters have established profiles with false credentials on professional social networking sites such as Linked-In to lend a bogus air of legitimacy to their scams, MessageLabs reports.

Storm Front

The Storm Worm Trojan surfaced on 17 January 2007 in emails seeking to trick recipients into visiting maliciously-constructed websites by purporting to give information on the storms ravaging Europe at the time.

Since then the Russian authors of this malware have refined their tactics. Their ability to adapt a variety of social engineering tricks to infect gullible users has become a hallmark of Storm's success.

The main attack methodology - tricking users into visiting maliciously constructed websites that attempt to load botnet clients onto vulnerable PCs - has remained much the same.

Compromised machines, however they are infected, become zombie clients under the control of hackers. The Storm Worm was the first botnet client to be based on a peer-to-peer (P2P) command and control protocol, an approach that makes networks of compromised PCs far more difficult to shut down ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.