Botnet controllers are switching to stealth tactics in a bid to avoid detection. Instead of mass mail-outs of spam and malicious code, they are adopting slower distribution tactics in a bid to avoid appearing on corporate security radars.

UK-based web security firm BlackSpider Technologies reports that one huge botnet, responsible for issuing 50m identical spam emails per day, compromises at least 150,000 distinct IP addresses. The use of a large number of machines - each sending out an average of 330 emails a day or around 40 per hour during the course of a working day - is a change from days of yore when a handful of compromised email servers would have been used to do the same job.

BlackSpider Technologies CTO James Kay said this low mail-out rate means users of compromised machines will not notice anything untoward with their net connection. Because they don't notice anything amiss, the spambot remains undetected. "It’s about time law enforcement agencies took the botnet issue far more seriously. Ninety-eight per cent of spam and malicious code comes from machines with bad or unknown reputations, and we should be slapping online ASBOs (anti-social behaviour orders) on them to stop this criminal cycle," Kay said.

Kay added that spam purveyors are adopting the same stealth tactics as VXers. "It’s not dissimilar to the low-volume virus distribution tactic that we first saw last year, when hackers realised that releasing viruses in smaller numbers kept them out of sight of anti-virus vendors for far longer, causing more damage." ®

Related stories

• SoBig anniversary marks birth of the botnet (9 January 2008)
• Spam: now made in China (4 December 2006)
• BT debuts 'spam-buster' system (12 October 2006)
• Virus infections drop, spam on the up (4 October 2006)
• Open source blamed for malware development (18 July 2006)
• Junk mail scumbags in harvesting attack (26 June 2006)
• Ransomware Trojan cracked (6 June 2006)
• Spam deluge eclipses email virus threat (1 June 2006)
• Virus writers at war (5 April 2006)
• Joe-job spammers shift tactics to evade filters (30 March 2006)
• Three charged with Seattle hospital botnet attack (14 February 2006)
• Botnet control fears over IP telephony (26 January 2006)
• Malware potency increases as numbers drop (25 January 2006)
• Bot herder pleads guilty to 'zombie' sales (24 January 2006)
• Pump-and-dump spam domains go silent after botnet closure (14 November 2005)
• Updated Virus writers craft PnP botnet client (24 October 2005)
• Arrests 'unlikely' to impact botnet threat (13 October 2005)
• Dutch smash 100,000-strong zombie army (7 October 2005)
• Bot herder websites in internet take-down (13 September 2005)
• Send-Safe spam tool gang evicted by MCI (1 March 2005)