Botnet researchers believe that the Storm botnet may be dead. It’s been a month since it last sent any spam, which is very unusual for a botnet. The only activity researchers have detected is that of some Storm-infected machines contacting one another and the host machines appear to be turning away any that try to connect to them. Since every minute of non-activity costs them money, it’s likely the massive botnet has been abandoned by its creators-possibly for another, more powerful one. Storm is made up of about 47,000 infected PCs.

“If they have the intention of keeping this operation up, they would at least have had to remain in maintenance mode where they keep something [spamming] out there… so when they were ready for the next big spam or social engineering thing, the botnet is there and at the ready, and they don’t have to wait for it ramp back up again,” said Joe Stewart, director of malware research for SecureWorks.

Other theories abound, including speculation that someone or something is interfering with the giant botnet via reverse engineering of its RSA key. Some experts believe the reason behind its decline and apparent abandonment is Microsoft’s Malicious Software Removal Tool, which started detecting it and cleaning up infected systems late last year. Its creators may also have been scared away by all the attention Storm received from experts and the media.

Despite Storm’s apparent demise, there are still several other active botnets around, including Rustock, Ozdok, Cutwail, and the net’s largest, Srizbi, and the massive amounts of spam being pumped out by them makes Storm’s absence nearly unnoticeable as far as spam volume goes. It will be interesting to see if Storm is truly dead or just being reinvented… something that will be revealed in the coming months.