MessageLabs spots resilient new breed of botnets

Closing down botnets is becoming increasingly difficult

Activity levels for Cutwail, one of the world's largest botnets, fell by 90 per cent after the recent shutdown of a Latvian ISP, but sprung back within just 48 hours, according to MessageLabs.

The security firm's latest Intelligence report makes for worrying reading, particularly concerning the increasing resilience of botnets.

By contrast, when the McColo web hosting firm was shut down in November last year it took the associated botnet activity several weeks to fully recover.

"The impact when the ISP in Latvia was taken offline was almost immediate but only lasted a short time. Within 48 hours it was back up and running, which is a worrying trend," said senior MessageLabs analyst Paul Wood. "A lot of efforts are being made behind the scenes to make them harder to take down."

Botnet herders are increasingly looking to peer-to-peer channels, distributed chat room and server operations and even HTTP traffic to manage and update the botnets and make them more difficult to track and take down, according to Wood.

"It needs increased law enforcement and greater [industry] co-operation," he said. "Anyone can set up an ISP, so it's often difficult to identify the bad ones from those which are genuinely struggling with the problems on their networks because they only have a small abuse department."

The report also highlighted the continued use of shortened URLs in spam emails, sent primarily from the Donbot botnet, as well as a 44.7 per cent increase in web-based malware since July, representing 3,510 new infected web sites every day.