Feeds

Waledac zombie attacks rise from the grave

As hard to kill as a horror movie baddie

Intelligent flash storage arrays

Updated Update: Trend Labs has reclassified the malware as a Bredolab variant instead of Waledac. That means the central premise of out original story - that Waladec - is back from the grave - is wrong.

"An unfortunate combination of human and machine errors let to the mislabeling of this threat as Waledac. Apologies for the confusion," it said.

Attacks designed to draft new recruits into the infamous Waledac spambot network are back from the dead, months after the zombie network was effectively decapitated.

Court-issued takedown orders against scores of Waledac-related domains were combined with the disruption of the botnet's peer-to-peer communications and traditional server takedowns to shut down Waladec's command and control structure back in February.

The Microsoft-led operation was rightly hailed as a big success but did nothing to clean up an estimated 90,000 infected bot clients even though it stemmed the tide of spam from these machines. Left without spam templates or instructions, these machines have remained dormant for months.

However, over recent weeks, the botnet is making a comeback of sorts. Spammed messages containing malicious attachment harbouring Waladec agents and disguised as tax invoices or job offers and the like have begun appearing, Trend Micro warns.

The same run of spam messages is also being used to spread fake anti-virus and other scams unrelated to Waledac, and there's no sign that a new command and control structure, much less a fresh round of spamming, has begun.

Nonetheless, security watchers are monitoring the development anxiously. "Waledac is making a comeback of sorts even if its main C&C servers have been removed from the picture," writes Jonathan Leopando of Trend Micro. "Even if you can deal with one aspect of a threat, others can still cause problems down the road."

The last E-variant of the infamous Conficker worm downloaded Waledac spam clients and SpyProtect 2009, a scareware product, onto compromised PCs back in April 2009, but previous distribution methods for the malware have largely focused on infected email attachments, as with the latest attack. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.