Spam Botnet Output on the Rise

• By Dian Schaffhauser
• 02/05/09

Symantec's MessageLabs says that spam levels are up nearly 5 percent since December 2008 thanks to the efficiency of existing botnets and the launch of some new ones. MessageLabs' most recent Intelligence Report said that in January 2009, the global ratio of spam in e-mail traffic from new and previously unknown bad sources was 74.6 percent (one in 1.92 e-mails). The report also cited spam botnet Mega-D (Ozdoc) for having the highest throughput in January, sending more than 26 million spam e-mails per minute. Cutwail (Pandex) remained the largest botnet with more than a million active IPs. Some of the top 10 most active botnets contributing to the spam increase are new to the threat landscape, including Xarvester, Donbot, and Waledac.

"The potential of these botnets to spam in large volumes is a major concern," said Paul Wood, intelligence analyst for MessageLabs. "In particular, Waledac is believed to be the next generation of the infamous botnet Storm (Peacomm). Whilst Waledac malware was spread at an alarming rate in January, it was dispersing spam in relatively small volumes. For now, the botnet controllers are clearly focusing on growing and developing this new botnet resource rather than using it to spam. It will be one to watch as 2009 progresses."

Current popular topics for spammers currently include the sale of penny stock, the US Presidential Inauguration, and unrest in the Middle East.

The report also said that an average of 1,208 new Web sites are launched each day harboring malware and other potentially unwanted programs such as spyware and adware, an increase of 6.2 percent since December 2008.

On the e-mail front, MessageLabs reported that the global ratio of e-mail-borne viruses in e-mail traffic from new and previously unknown bad sources was one in 257.3 e-mails (0.39 percent), a decrease of 0.12 percent since December 2008. But in the education sector, the virus ratio actually decreased by 0.57 percent even as it held the highest virus levels with one in 98.8 e-mails being infected.