In an early draft of the MessageLabs results sent to The Tech Herald, MessageLabs Intelligence Senior Analyst, Paul Wood, mentions the Waledac botnet in a pre-Microsoft observation. Waledac, the botnet many experts agree replaced the botnet created by the Storm Worm, was mostly silent in January. In fact, Waledac had been relatively quiet since January 2009.
Looking back, Symantec recalled that Malware from Waledac first spiked in January 2009 and a year later in January 2010, each spike accounting for approximately one percent of all Malware intercepted by MessageLabs’ network.
“Malware connected to Waledac [is] not distributed by the botnet itself.” Wood mentions in the draft, noting that it’s actually sent by other botnets.
“Recently, Waledac Malware has been sent from the Cutwail botnet. Also noteworthy is that Spammers
using the Waledac Malware seem particularly focused on the major free webmail hosting services using Email addresses in use by individuals.”
One of the reasons behind Operationb49, Microsoft’s internal name for the legal action behind their takedown of the Waledac botnet last week, was due to the massive amounts of Spam that hit their Hotmail Webmail service. At one point, Microsoft said, Waledac was responsible for over 651 million junk email messages hitting Hotmail on December 3-21 2009. Microsoft and other security firms placed the total reach for Waledac at about 1.5 billion emails a day.
Overall, Symantec’s new report notes that Spam levels jumped to 89.4 percent in February, just under a six percent growth from the levels observed in January.
The cause for the jump is due largely to the Grum and Rustock botnets, which could be an indication that they are gearing up to share the workloads once belonging to the Waledac botnet. The rise in activity could also be seen as an indication of a power play by the botnet controllers to grab over the orphaned Waledac host systems.
Over the past year, Grum has experienced little change in Spam volume, Symantec says, but from February 5, Grum’s output increased by 51 percent. This jump means that it is now responsible for 26 percent of all Spam online. Another significant spike in Spam volume occurred on February 17. The spike was caused by an increase in output from the Rustock botnet, resulting in a global volume jump of no less than 25 percent.
Globally, Spam levels in Italy reached 93.4 percent in February, positioning it as the most spammed country. In the US, 90.2 percent of email was Spam, and 88 percent in Canada. Spam levels in the UK fell to 88.6 percent, while Spam levels reached 89.5 percent in Australia and 91.3 percent in Germany.
The full report is available at http://www.messagelabs.com/intelligence.aspx
Source: thetechherald.com
.jpg)
