Malware Turns 25K Linux Servers Into Spam Distribution Botnet
A criminal group used a network of 25,000 compromised servers to steal credentials, redirect Web traffic to malicious content and send as many as 35 million spam messages per day.A sophisticated network of 25,000 compromised Linux servers has become the foundation of a massive cyber-criminal botnet capable of sending 35 million spam messages and redirecting more than 500,000 Web visitors to exploit kits every day, according to a report published by software security firm ESET. A collection of malware, dubbed Windigo by ESET, forms the basis for the cyber-criminal infrastructure. A Linux backdoor, known as Linux/Ebury, steals credentials to infect other servers, while another backdoor, known as Linux/Cdorked, compromises Web servers and redirects traffic. The collection of programs has created an impressively sophisticated network that can distribute spam, redirect Web traffic and infect users' computers with malware, while hiding the location of the criminals behind the attacks, ESET Security Researcher Olivier Bilodeau told eWEEK. "The whole thing is really well put together," he said. "When we were trying to find who is behind the operation, we found it very difficult."
The investigation into the first of the malware components began in September 2011, after an attack against the Linux Foundation that compromised more than 400 users of kernel.org, the report stated. Researchers from ESET, the Swiss computer emergency response team CERT-Bund, the Swedish National Infrastructure for Computing, and the European Organization for Nuclear Research (CERN) teamed with other organizations to create a working group to study the malware.