World’s third largest botnet receives mortal blow
Grum, a botnet responsible for 17.4 percent of the world’s spam emails, finally seems to be dead.
In the last few days, Dutch authorities have shut down two of the botnet’s secondary C&C servers pointing to IP addresses 94.102.51.226 and 94.102.51.227.
Still, as FireEye researchers pointed out, the botnet couldn’t be terminated until the rest of the active servers – one master server in Panama and another in the Russian Federation – were taken offline.
The shutdown of those servers would have guaranteed the end of Grum, as the botnet has no fallback mechanism and has only a handful of master IPs hard-coded inside its binaries.
FireEye’s security researchers Atif Mushtaq, credited with bringing the existence of the two aforementioned servers to the Dutch authorities attention, hoped that his awareness raising efforts about the botnet’s existence would result in the research community and various national authorities banding together to stomp it out.
As it turns out, even though the Panama and Russian ISPs hosting the remaining to servers initially ignored the abuse notifications FireEye sent to them, the former buckled under the pressure applied by the community and shut down the server on Tuesday.
“With the shutdown of the Panamanian server, a complete segment was dead forever,” Mushtaq explained.
But the action didn’t go unnoticed by the bot herders, who reacted by pointing the remaining C&C to new secondary servers in Ukraine – a country notorious for being a safe haven for bot herders and in which shutting down any servers has always proven difficult.
“I immediately shared this new information with three different parties – Carel Van Straten and Thomas Morrison from Spamhaus, Alex Kuzmin from CERT-GIB, and an anonymous researcher who goes by the pseudonym Nova7,” Mushtaq shared. “After they got all the evidence from my side, they moved quickly passing this intelligence back to their contacts in Ukraine and Russia.”
The action resulted in all six new servers in Ukraine and the original Russian server to be shut down on Wednesday – the latter after the server-hosting ISP’s upstream provider null routed the IP address in question.
“Every takedown that I have participated in, such as Srizbi, Rustock 1, Ozdok, and Cutwail 1, has given me a unique experience,” says Mushtaq. “So what have I learned from this takedown? When the appropriate channels are used, even ISPs within Russia and Ukraine can be pressured to end their cooperation with bot herders. There are no longer any safe havens.”