Activity levels for Cutwail, one of the world's largest botnets, fell by 90
per cent after the recent shutdown of a Latvian ISP, but sprung back within just
48 hours, according to MessageLabs.
The security firm's
latest
Intelligence report makes for worrying reading, particularly concerning the
increasing resilience of botnets.
By contrast, when the McColo web hosting firm was
shut
down in November last year it took the associated botnet activity several
weeks to fully recover.
"The impact when the ISP in Latvia was taken offline was almost immediate but
only lasted a short time. Within 48 hours it was back up and running, which is a
worrying trend," said senior MessageLabs analyst Paul Wood. "A lot of efforts
are being made behind the scenes to make them harder to take down."
Botnet herders are increasingly looking to peer-to-peer channels, distributed
chat room and server operations and even HTTP traffic to manage and update the
botnets and make them more difficult to track and take down, according to Wood.
"It needs increased law enforcement and greater [industry] co-operation," he
said. "Anyone can set up an ISP, so it's often difficult to identify the bad
ones from those which are genuinely struggling with the problems on their
networks because they only have a small abuse department."
The report also highlighted the continued use of shortened URLs in spam
emails, sent primarily from the Donbot botnet, as well as a 44.7 per cent
increase in web-based malware since July, representing 3,510 new infected web
sites every day.
Do you agree?
Have your say on this article