Feeds

Pushdo Trojan outbreak: 11 THOUSAND systems infected in just 24 hours

Just 77 machines in the UK, though

Secure remote control for conventional and virtual desktops

A wave of attacks by cybercrooks pushing a new variant of the resilient Pushdo Trojan has compromised more than 11,000 systems in just 24 hours.

Indian PCs have been most affected by the outbreak, but systems in the UK, France and the US have also been hit, according to security software firm Bitdefender.

The Romanian firm reckons 77 machines have been infected in the UK via the botnet in the past 24 hours, with more than 11,000 infections reported worldwide in the same period. Other countries that have been heavily affected by the Pushdo variant include Vietnam and Turkey.

Bitdefender figures come from traffic towards the sinkholed domains associated with the botnet's control system.

Traffic to these seized sinkholes came from 11,000 unique IP addresses in a period of 24 hours. These pings represent infected hosts phoning home for instructions.

The most affected region seems to be Asia, with India and Vietnam topping the list of compromised hosts and accounting for around 10 per cent of infections each. The US accounts for another 5 per cent of the total.

“We managed to successfully intercept Pushdo traffic and gain some idea of the size of this botnet,” states Catalin Cosoi, chief security strategist at Bitdefender.

“The sheer scale of this criminal operation, unsophisticated as it may be, is rather troubling and there are indications that the botnet is still in a growth phase. We shall be continuing our investigation as a key priority and further updates shall be made available in the coming days.”

The Pushdo Trojan has been used to distribute secondary malware strains such as ZeuS and SpyEye, but over the years its main use has been geared towards spam distribution. The actually spamming is done through a commonly associated components called Cutwail that are frequently installed on compromised PCs.

Despite four takedowns in five years against Pushdo command-and-control servers, the botnet endures.

The public and private keys used to protect the communication between the bots and the C&C servers have been changed with the latest variant, but the communication protocol remains the same.

The latest Pushdo binaries add an encrypted overlay not found in previous versions. If the conditions specified in the overlay are not met, the sample does not run properly.

The DGA (Domain Generation Algorithm) used by the latest variant has also been slightly revamped. DGAs are used to periodically generate a large number of domain names the zombie hosts can ping for instructions. The approach (pioneered by the infamous Conficker worm) makes life harder for law enforcement. Its successful application in this malware goes a long way towards explaining the resilience of Pushdo. ®

Beginner's guide to SSL certificates

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.