Highlights

1. Collectively the top botnets are capable of sending over 100 billion spams per day
2. Srizbi maintains the top spot both in terms of number of bots and spamming capacity
3. Storm is only a fraction of its former self, and is rapidly becoming a minor player
4. Bobax, probably the longest-lived of the template-based spamming botnets is still around, and ranks #2 in number of bots
5. Ozdok/Mega-D is still relatively small in numbers, but makes up for its diminutive size with aggressive amounts of spam sent per bot

Introduction

In the last four years, spambots have made a transition from proxy-based spamming to template-based spamming. The first proxy-based spam botnet was Sobig, circa 2003, and it was quite impressive for its day. However, spammers rapidly discovered that even though they were able to disguise their origin by proxying through infected hosts, they still had to expend a lot of resources (and money) maintaining banks of machines and network connectivity to pump spam through the proxy servers day and night. In addition, the introduction of consumer-level NAT routers caused many of these proxies to be unreachable from the Internet, since the infected computers had private (RFC1918) IP addresses.

Around 2004 we saw the first template-based spamming botnets, designed to solve this problem. By sending bots a spam template along with a list of email addresses, the work (and wait) of connecting to remote mailservers could be offloaded to each individual bot. With the switch to a template-based system, spam botnet efficiency increases exponentially.

Fingerprinting Spambots

Since each individual bot implements the SMTP protocol with minor differences, it is possible to develop fairly effective network-based signatures to differentiate between the different botnets, that don't rely significantly on message headers/content. Although SecureWorks is not an anti-spam company, we have significant vision into networks receiving vast amounts of spam. This, combined with the intelligence we have gathered over the past several years around spambots, gives us the ability to collect some useful statistics concerning just how big these botnets are, and how well they work. Below is some of this data, which we hope will be of use in helping other parties understand the current state of botnet spam and classifying the individual malware more accurately.

Counting Botnet Sizes

In order to count the botnet sizes, we take a sample of one day's spam traffic from that bot across our customer base. Then, using probabilistic counting methods, extrapolate the likely total number of bots in the botnet. Simply put, if we see the same bots sending the same spam to multiple customers, it is more likely that the botnet size is smaller than a botnet where we rarely see the same IP address sending spam to more than one of our customers in the same time period. Based on data gathered from control server logs we've obtained in the past, we have confirmed that this method of counting can be fairly accurate in estimating botnet sizes.

We also try to list other information that may be of use to analysts, including alternate names for the malware. We've tried to leave out generic names that are used when AV companies don't recognize an established malware family, such as Mailbot, Spamtool, Spambot, Agent, Delf, Pakes, etc. Also, we try to avoid listing names that are frequently misassigned, such Tibs, Peed and Zlob. Although these are not generic names, the wrong malware is frequently given these names due to the massive amount of cross-installation of malware occurring these days, driven by pay-for-install exploit sites. Also, where possible, we try and list strings that might be found in the binary or network traffic of the spambot - however, in most cases the malware is packed/encrypted, and will need to be unpacked before any such strings can be found in the malware.

With that said, here are the biggest spam botnets we are seeing:

Other Spambots

In addition to these bots, there are several other template-based spam botnets, and still many more proxy-based botnets. Creating network-based fingerprints for proxy botnets is much more difficult, because ultimately you are fingerprinting the mailer engine, not the bot itself. In the case where the same spam tool might utilize multiple proxy botnets, it would greatly skew the results.

One template-based botnet (Warezov/Stration/Opnis) that was a major player six months ago has completely dropped off of the radar. Warezov was known for sending Chinese pump-and-dump stock spam. Perhaps it is no coincidence that in the same time frame that we stopped seeing Warezov spam/malware, the notorious spam kingpin Alan Ralsky was arrested and charged (among other things) with sending pump-and-dump stock spam for Chinese companies.

Conclusion

Template-based spam botnets are here to stay. Not only that, based on what we've seen in the lab we don't believe they've even achieved the level of efficiency of which they could be capable, as can be demonstrated by the wide range of capacity between the different botnets relative to their sizes. However, it may be somewhat surprising to some that less than a million hosts are responsible for the majority of spam, when we constantly hear statistics that suggest anywhere from 10% to 60% of all Windows PCs are infected with some sort of malware. It could be quite possible that all these botnets are massively larger, but most of the bots are unable to send spam, either because they are behind an SMTP-blocking firewall or located at an ISP which does not allow direct-to-MX mail from their customer base. If this is the case, perhaps the botnet counts we see here will drop even further. But, as has been the case in the past, spammers will simply adapt, and find new methods to pummel the world's networks.