Virus-Laden Spam Skyrockets After Rustock’s Death

Security researchers have detected a sharp rise in the amount of spam messages containing virus-laden attachments or links. They attribute this to the recent death of the Rustock botnet. Responsible for billions of spam messages, its shutdown likely left quite a few spammers and phishers scrambling to deal with a serious financial hit. The sudden flood of malicious messages is believed to be a frantic attempt to build a replacement botnet as quickly as possible, and the death of terrorist Osama Bin Laden is certainly helping them. Bin Laden themed spam and malware is currently pounding the net, especially on sites like Facebook. 1 out of every 169 emails sent now contains a malicious link or attachment, a 24% rise since March.

A smaller campaign seems to be targeting the unemployed and those with financial struggles.  I recently received several spam messages from my best friend containing links promising to lead to lucrative work-at-home job opportunities. The links were obscured using an url shortening service. I found out from someone who had received an identical message and foolishly clicked on the link that it led to a site that tried to install a Trojan.

The attempt to rebuild seems to be working – there’s been a 71% increase in zombies detected in the last month. It’s not clear what botnet is responsible for most of them but what is clear is that botnet shutdowns are still not as effective as we’d like. The chilling effect they have on spam is still quite temporary. While we’re making progress we still have a lot of work to do.