Experts link flood of 'Canadian Pharmacy' spam to Russian botnet criminals

Page 2 of 3

The "Canadian Pharmacy" domains get set up and torn down at a rapid pace, and when someone getting the pharma spam does place an order for drugs — Glavmed advertises about 75 prescription medications, including Cialis, Viagra, Zoloft, Lipitor, Prozac, Valium and Darvon — the order is fulfilled.

As part of his research, Peterson says he ordered a number of advertised medications from a "Canadian Pharmacy" spam Web site.

“They never ask for a prescription,” said Peterson. “The original pills are being shipped out of Mumbai, India, and subsequently from Shanghai and China. The brand imprint is bogus.” For example, Peterson said, “it's not a Viagra pill made by Pfizer, but a ripoff pill with the actual ingredients.”

Peterson also said there is a legitimate company Canada Pharmacy, which he spoke with “and they’re mad as hell.”

GlavMed, whose site logo features a woozy snake drinking from a martini glass of pills, is “the master criminal” behind the "Canadian Pharmacy" pharma spam blitz and also appears to control Spamit.com, says Cisco's Peterson. GlavMed has its roots “most certainly in Ukraine or Russia,” he adds.

Stefan Savage, associate professor of computer science at University of California at San Diego, who has studied botnet activity, says it’s difficult to know exactly what GlavMed is up to.

But “there is a great deal of spam for the 'Canadian Pharmacy' template, that is, the sites look the same, sent by different botnets” Savage notes this same template is also provided by GlavMed to its affiliates.

Savage adds that GlavMed could claim that its “templates were stolen and they aren’t behind it all.,” but there is strong circumstantial evidence linking them.

Some online groups, such as Spamtrackers, are keeping their own notes about "Canadian Pharmacy" and Glavmed, he points out. Opinions at Spamtrackers are severe, claiming fraud on several accounts and a connection to Russian cybercrime.

The "Canadian Pharmacy" spam started about four or five years ago, says Joe Stewart, director of security research at Atlanta-based firm SecureWorks. GlavMed does appear to be a spam sponsor and most of the spammers are Russians, he says.

GlavMed has come up with a “turn-key campaign” model for pushing fake meds that appears to be working, and because GlavMed doesn't appear to actually send the spam, “they put all the risk on the affiliates that are spamming — they distance themselves from crimes going on.” He adds it's uncertain if this type of spamming activity would even be considered illegitimate in Russia.

Spammers making hits with "Canadian Pharmacy" counterfeit drugs are usually paid by GlavMed via what’s called WebMoney, says Peterson.

WebMoney is an online payments system that also has offices in Russia and Eastern Europe, that can be described as “PayPal meets Western Union,” he says. WebMoney , owned by WM Transfer Ltd, offers payments in dollars, Russian rubles, Euros and other monetary units. “It’s probably also used for legitimate things as well as being attractive to criminals,” Peterson adds.