A botnet that experts believe sent 18% of the world's spam e-mail messages was recently shut down, according to a report by a security firm.
Grum's control servers were mostly based in Panama, Russia, and Ukraine. Security company FireEye and spam monitoring service SpamHaus worked in cooperation with local Internet service providers and shut down the illegal network. A botnet is a network of computers that have been hijacked by cybercriminals, in most cases using malicious software.
FireEye security researcher, Atif Mushtaq, states that the takedown of Grum is the result of the joint effort of a large number of people and that this cooperation sends a strong message to all spammers. Mushtaq states that at the beginning of the week he found out that the Dutch server that was part of Grum was also shut down, which was followed by positive news about the shutdown of the server in Panama, however, Grum started its activities again, but this time from the territory of Ukraine.
Shutting down Groom represents one of the largest efforts to neutralize botnets worldwide. Russian Georgiy Avanesov was jailed for four years in May this year for being the mastermind behind the Bredolab botnet, which is believed to have generated more than £80,000 a month in revenue.
Microsoft has been working to disable Zeus, another major network responsible for the theft of several million pounds. FireEye also worked with other experts around the world to put as much pressure as possible on local ISPs to suspend illegal operations. Mushtaq states that more than 20,000 computers are still part of the botnet, but that without active CnC, they too will soon become ineffective.
The downing of Grom represents a big step forward in combating the spread of botnets around the world, Mushtaq believes, since there is no paradise for such activities anywhere. Most of the spam botnets that kept their CNC in the USA and Europe have moved to countries like Panama, Russia, and Ukraine thinking that nobody can do anything to them in these territories but now it is possible to pressure local internet providers to deny them service and thus help eliminate such illegal networks.
Comments
Post a Comment