'Donbot' launches pump-and-dump run

Pump-and-dump spam attacks look set for a comeback

A huge botnet credited with launching an attack on Twitter and Facebook last month has moved into pump-and-dump spam attacks.

The Donbot network has recently been connected by researchers to a rash of stock-related spam messages that attempt to persuade users to invest in a low-priced stock. Once demand for the stock has inflated its price, the spammer then sells at a profit.

Researchers at MessageLabs said that the attack is unique because pump-and-dump scams, once a common occurrence, have all but disappeared in recent years. Much of the drop was attributed to the arrest and conviction of spam kingpin Alan Ralsky.

However, with the changes believed to be taking place in the cyber crime world, such attacks could soon return to favour. Experts throughout the industry have predicted that an increasingly crowded and competitive market could force criminals to look for new ways to make money online.

The size and structure of new botnets may also play a part. MessageLabs senior analyst Paul Wood noted that stock spam operations are perfect for Donbot and other large botnets.

"The people behind the scam will have already purchased their stock and, when the stock price rises, they sell it and make a big profit," said Wood.

"This technique is perfectly suited to botnet activity as it requires large volumes of mail to be sent at one time."