Backup for spammers

Disaster recovery experts take note. One of the largest and most active botnets, US-based Cutwail, was able to recover in a few hours after the shutdown of its host ISP, Pricewert, an indication of how well spammers have adopted backup and recovery technology.

"Cutwail's recovery to one-third of its original levels, after only a few hours, highlights the progress spammers have made since the McColo shutdown in November," said Paul Wood, MessageLabs Intelligence senior analyst, Symantec. "Spammers have learnt the importance of having a backup for command and control channels." His comments came during the release of MessageLabs' June 2009 MessageLabs Intelligence Report.

The study also revealed that spam from botnets accounted for 83.2 per cent of all spam worldwide in June. The remainder is sent from compromised mail servers and webmail accounts. The image spam accounted for eight to 10 per cent of all spam. The newest versions originate from botnets, contain background noise patterns and are delivered as an e-mail attachment rather than hosted remotely.

Meanwhile, the report found that one in 405 messages from instant messaging (IM) applications contained a hyperlink of which one in 78 were linked to websites hosting malicious content, an increase of 78 per cent over the past six months. At the end of 2008, MessageLabs Intelligence had identified that one in 200 hyperlinks shared over public IM applications were malicious. At the current rate, one in 80 IM users may expect to receive a malicious instant message each month.