New blood rejuvenates botnet ranks

Botnets are now responsible for 87.9 per cent of all spam

Security researchers have warned that the growth of new botnets and the resurgence of existing networks has helped to push malware infection numbers to record highs.

The latest report from Symantec's MessageLabs branch said that the swelling ranks of malware-controlled computer networks are now responsible for 87.9 per cent of all spam worldwide.

Much of this activity was credited to a resurgence of the Rustock botnet, which accounted for an estimated 10 per cent of all spam activity. The total number of machines in the botnet is thought to be 1.9 million.

Researchers also noted that Rustock has adopted a regular schedule for sending out spam. The junk mail runs begin each day at around 8:00am GMT, and the first four hours are the busiest. The spam flow continues until roughly 8:00pm each evening.

Joining Rustock atop the botnet ranks was a new infection known as Maazben. Dealing mainly in casino-related spam messages, Maazben is believed to be just five months old. Despite its recent debut, the network is said to be serving 1.4 per cent of total spam loads.

MessageLabs senior intelligence analyst Paul Wood suggested that the closure of ISPs known for harbouring botnet operators, such as McColo, has helped to take down older networks, leaving a void in the botnet industry.

"This has undermined the power of the more dominant botnets like Cutwail, and cleared the way for new botnets like Maazben to emerge," said Wood.

"However, this won't always be the case as botnet technology has also evolved since the end of 2008, and the most recent ISP closures now have less of an impact on resulting activity as downtime only lasts a few hours rather than weeks or months as before."