41% of spam sent via Rustock botnet

Botnet spam back after short summer break.

In its latest intelligence report, security firm MessageLabs reports that 41% of all spam is being sent through the Rustock botnet, an increase of 9% since April. The botnet sends an estimated 32 million spam emails per minute.

Interestingly, the number of bots controlled by Rustock's botherders has almost halved in the same period. One of the reasons for this apparent contradiction appears to be the drop in the use of TLS for sending the spam.

TLS makes use of an encrypted connection to send the messages and botherders may have believed this would decrease the chances of their messages being intercepted; in April, 30% of all spam and 70% of Rustock spam was send using TLS. However, TLS significantly slows down the connection, and with now less than 0.2% of spam being sent over TLS connections, spammers seem to have realised that their delivery rates were being significantly impacted by its use.

Currently 92.2% of all email is spam - an increase of 3.3% since July; 95% of these spam messages are sent via botnets. The relatively low spam ratio in July is explained by a temporary drop in spam coming from a number of botnets, most notable the Grum botnet.

In August, Grum's output increased again and it now takes up second position among the most prolific spamming botnets, with over 16% of spam sent through its bots. While Rustock has mostly infected computers in Western countries, Grum's bots are more likely to be found in Russia, India and Vietnam.

The full MessageLabs report can be found here (PDF), with comments on how this affects those sending legitimate email at the Word to the Wise blog here.

Tags: botnet, grum, messagelabs, rustock, spam, tls. Posted on 26 August 2010 by Virus Bulletin. Leave a comment.

0 comments

 del.icio.us  digg this! digg this

0 comments

Leave a comment

Login to leave a comment

Please login to leave a comment - or click here to register if you are a new user.

Quick Links

Poll
Should software vendors extend support for their products on Windows XP beyond the end-of-life of the operating system?
Yes - it keeps their users secure
No - it encourages users to continue to use a less secure OS
I don't know
Leave a comment
View 24 comments

AusCert2014

VB100 certification
VB100 For the first time in living memory, this test saw a clean sweep of certification passes, with all products reaching the required standard for a VB100 badge, and most also doing well in terms of stability.
See full results.

Virus Bulletin currently has 231,344 registered users.