Storm worm dethroned by sex botnet

by Darren Pauli

February 4, 2008 —

Romance is out and sex is in, according to security experts who said the Mega-Dik
botnet has ousted the infamous Storm as the most prolific sender of spam.

The Mega-D botnet, which offers discounted sexual enhancement pills to users,
delivers a whopping 30 percent more spam than Storm, famous for delivering malicious
Valentines cards.

It is the largest botnet on record, according to security firm Mashall, and
has exceeded Storm's highest spam output in September last year by 12 percent.

Marshal vice president of products Bradley Anstis said Storm-based spam has
been cut down to 2 percent due to its high media attention.

"The Mega-D operation is responsible for huge volumes of spam. Over the
past year spam from this botnet has grown significantly and it has exceeded
Storm's previous spam records without attracting nearly as much media attention,"
Anstis said.

"Just two weeks ago we saw a renewed campaign to distribute the Storm
malware under the guise of a love letter. Perhaps Storm has become a victim
of its own success as Microsoft has been targeting Storm with its malicious
software removal tool since September last year."

Microsoft has flushed about 200,000 computers clean of Storm since September,
according to Anstis.

Mega-D has borrowed a few tricks from Storm, such as operating in Asian countries
typified by high broadband penetration and poor use of anti-virus, using Trojans
to dodge signature-based removal techniques and proliferating over peer-to-peer
networks.

Anstis said the creators of Storm may be behind the Pushdo botnet, one of the
most active based on infection, based on similarities between the two.

"There is a lot of crossover between the products promoted by all of the
botnets we're tracking," Anstis said.

"These people are cunning and one lesson they may have learnt from Storm
is to stay under the radar if they want to remain successful."

He said Mega-D has targeted Facebook users with a fake invites that downloads
the Trojan using a phony Flash Player update.

More than 70 percent of global spam is sent from botnets Mega-D, Pushdo, HTML,
One Word Sub and Storm.

Computerworld Australia