Feeds

Kelihos zombies erupt from mass graves after botnet massacre

Pumping spam, entering backdoors again almost right away

Build a business case: developing custom apps

Security researchers have warned that the resurrected Kelihos botnet blasted off the face of the web yesterday is still alive.

Experts not involved in the blasting say the miscreants behind the network of compromised Windows computers are working on their comeback. The zombie PC army was walloped offline in September, they say, yet later resurfaced.

Seculert reports that Kelihos-B, which was distributed as a Facebook worm over recent weeks, is still active and spreading - even after the shutdown attempt by CrowdStrike and Kaspersky Labs this week.

Seculert views this botnet as the undead remnants of Kelihos-B rather than the spawn of a new variant of the malware.

The findings suggest that sink-holing 109,000 backdoored machines infected with the spam-spewing and credential-stealing Kelihos Trojan may not have disabled the entire bot network.

"Very little time passed yesterday [Wednesday] between action being taken against the second Kelihos botnet and the appearance of a new variant said to be spreading via Facebook," commented David Harley, senior research fellow at antivirus biz ESET.

"For the time being, the teams involved in the partial disabling of the Kelihos botnet, have implemented another pretty good temporary fix.

"Sink-holing has twice reduced the effectiveness of Kelihos botnets by effectively disabling and diverting communications from infected machines to a system that is now under the control of the 'good guys'. However, there’s a significant risk that machines that are still infected are also likely to fall prey to a new Kelihos botnet, apart from the risks to currently uninfected machines."

Harley added that the gang are in possession of the Kelihos source code, and can therefore tweak the malware to evade future attempts to neutralise it. ®

Next gen security for virtualised datacentres

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?