Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cloud
    • Cloud
    • Cybersecurity
    • Networking

    Chat Logs Reveal Origins of Cutwail Botnet, Botmaster Identity

    By
    Fahmida Y. Rashid
    -
    January 5, 2012
    Share
    Facebook
    Twitter
    Linkedin

      Russian investigators have uncovered chat logs between the botmaster in charge of the “Cutwail” botnet and a founder of a fake pharmaceutical spam operation that hint at the botmaster’s identity.
      The chat logs were discovered by Russian law enforcement on a computer belonging to Dmitry Stupin, a co-founder of “SpamIt,” according to Brian Krebs, a security writer on Krebs on Security. SpamIt was the largest fake online pharmaceutical affiliate program in the world before closing its doors in October 2010.
      The chat logs provide a behind-the-scenes look into how Cutwail became the largest spam network in the world after Rustock was shut down as well as several clues to the identity of the person masterminding the operation. Previously included in the top three, Cutwail and its variants currently account for approximately 22 percent of all spam on the Internet, according to M86 Security.
      Using the codename Google, the person in charge of the Cutwail botnet had extensive dealings with Stupin. The botherder used close to a dozen affiliate accounts at SpamIt and made nearly $175,000 in commissions using Cutwail to advertise rogue pharmacies, according to Krebs.
      The botherder rented out Cutwail to other spammers and SpamIt affiliates were the biggest client base, according to Krebs. At some point, Stupin suggested using Cutwail to create a new affiliate program, Warezcash, to sell OEM software, such as pirated copies of Microsoft Windows and other popular software titles. Information on how to access various parts of the botnet infrastructure, including the interface, statistics, technical support forum and user manual, were also included in the logs.
      According to analysis by researchers at University of California at Santa Barbara and Ruhr-University Bochum in Germany, the Cutwail spam engine is rented to a community of spam affiliates who pay a fee to use the infrastructure. These “customers” receive access to a Web interface that simplifies the process of creating and managing spam campaigns.
      While Cutwail may have originally been used by cyber-criminals to send out fake pharmaceutical and software spam, in recent years, it has become “a major spam cannon” distributing malicious software such as Zeus and SpyEye Trojans, according to Krebs.
      Recently, Cutwail was observed sending out spam messages with subject lines relating to the Automated Clearing House, confirmation orders for airline tickets, scanned document or Facebook notifications, according to M86 Security researchers. The messages contained links which directed users to malicious sites which attempted to download malware on the victim machine.
      Cutwail has also been behind several “ransomware” attacks, where a hacker takes over the users’ files and blackmails the recipient to get them back, according to Krebs.
      The chat logs also contained some clues that may help Russian authorities track down the team behind Cutwail, such as the botmaster’s mobile number. The number appears to have been used to register a number of domains by a “Dmitry S Nechvolod,” according to historic WHOIS records. Krebs conceded this could be a pseudonym or an innocent bystander implicated in the scam.
      However, the chat logs also listed the account information for WebMoney, a popular system of virtual currency used in Russia and Eastern Europe, that SpamIt’s Stupin used to send affiliate payments due to Cutwail’s team. The name on the WebMoney purse was Nechvolod Dmitry Sergeyvich, according to Krebs.

      Fahmida Y. Rashid

      MOST POPULAR ARTICLES

      Cybersecurity

      Visa’s Michael Jabbara on Cybersecurity and Digital...

      James Maguire - May 17, 2022 0
      I spoke with Michael Jabbara, VP and Global Head of Fraud Services at Visa, about the cybersecurity technology used to ensure the safe transfer...
      Read more
      Big Data and Analytics

      Alteryx’s Suresh Vittal on the Democratization of...

      James Maguire - May 31, 2022 0
      I spoke with Suresh Vittal, Chief Product Officer at Alteryx, about the industry mega-shift toward making data analytics tools accessible to a company’s complete...
      Read more
      Big Data and Analytics

      GoodData CEO Roman Stanek on Business Intelligence...

      James Maguire - May 4, 2022 0
      I spoke with Roman Stanek, CEO of GoodData, about business intelligence, data as a service, and the frustration that many executives have with data...
      Read more
      Applications

      Cisco’s Thimaya Subaiya on Customer Experience in...

      James Maguire - May 10, 2022 0
      I spoke with Thimaya Subaiya, SVP and GM of Global Customer Experience at Cisco, about the factors that create good customer experience – and...
      Read more
      Cloud

      Yotascale CEO Asim Razzaq on Controlling Multicloud...

      James Maguire - May 5, 2022 0
      Asim Razzaq, CEO of Yotascale, provides guidance on understanding—and containing—the complex cost structure of multicloud computing. Among the topics we covered:  As you survey the...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×