Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Subscribe
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Subscribe
    Home Cloud
    • Cloud
    • Cybersecurity
    • Networking

    SpyEye Dominates Malicious Botnet Activity in 2011 First Half: Survey

    Written by

    Fahmida Y. Rashid
    Published September 7, 2011
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      Cyber-criminals may be employing new tactics and technology to execute their online campaigns, but botnets remain lucrative and effective, according to a report from Damballa.

      New botnets emerged in the first half of 2011 and were more active than older botnets, Damballa researchers found in its Threat Report for the first half of 2011. The criminals were also operating much smaller networks of infected machines, according to the report, released Sept. 7.

      Criminals are increasingly using do-it-yourself crimeware construction kits and exploit packs to power their malicious operations, Damballa found. Eight out of the top 10 botnet operators used off-the-shelf kits and modified the code or added new kits as the campaigns evolved, the report found. The “nearly indestructible” TDL/TDSS botnet and the one based on the Eleonore malware family were the only ones on the top 10 list not using DIY kits.

      “Criminal operators continue to hone their craft in 2011 using crimeware that can be repurposed for multiple fraud opportunities, sold or leased to other criminals,” said Gunter Ollmann, vice president of research for Damballa.

      While botnet operators “die,” new ones are always being “born.” Damballa found 67 more operators “set up shop” than went offline in the first half of 2011, meaning there were more botnets operating during that period than at the end of 2010. The ones that went offline often did so because of consolidation between various networks as an operator took over command-and-control for other botnet operators.

      Despite the excitement over various botnet takedowns this spring, “takedowns tend to represent an insignificant percentage of the actual number of operators that cease to exist,” the report found.

      Of the 10 largest botnets in the first six months of 2011, only three of them were on the list in 2010, Damballa said. OneStreetTroup, a botnet based on SpyEye crimeware, barely made the list in December at No. 10. Six months later, it had shot up to the top of the list and ranked No. 1 as the largest botnet observed during the period.

      RudeWarlockMob (the TDL/TDSS botnet) and FreakySpiderCartel (a botnet that pushed out fake antivirus software) both slid down one position to rank No. 2 and No. 3 respectively. All remaining botnets on the list, including the ones based on the Neosploit and Eleonore kits, Zeus Trojan, Gbot worm and Virut file infectors, either were first detected or grew dramatically during the first half of the year to appear among the top 10 for the first time.

      Damballa was not surprised that OneStreetTroop, the botnet based on the SpyEye toolkit became so prominent in the first half of the year. The integration ofZeus source code into SpyEye “combined the best of both crimeware development kits into a single commercial package,” making it more powerful and capable than ever, the researchers wrote. The fact that a cracked version of the SpyEye kit is now readily available means there will be “widespread adoption” of SpyEye in 2011 to launch additional campaigns designed for fraud, according to the report.

      The top three botnets together accounted for about 25 percent of the infected population while the entire top 10 botnets accounted for approximately 56 percent of all botnet compromised victims, Damballa said. The top 10 list accounted for only 47 percent in 2010.

      While large botnets “get all the attention and notoriety,” the majority of bot operators are managing smaller networks, Damballa found. The number of operators managing botnets with between 100 and 1,000 infected machines was more than double the number of operators managing networks with over 1,000 victims, the report found.

      The first half of 2011 “picks up where 2010 left off,” the researchers wrote.

      Fahmida Y. Rashid
      Fahmida Y. Rashid

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.