Botnets battling for digital real estate
April saw high activity from multiple botnets, namely Gumblar and Sasfis, according to a report by Fortinet.
While Gumblar remained in the No. 1 position in Fortinet’s Top 10 Network Attacks list, the Sasfis botnet ranking was bolstered by two of its executables prevalent in Fortinet’s Antivirus Top 10 listing.
Like Bredolab, Sasfis is a botnet loader that reports statistics and retrieves/executes files upon check-in. However, Sasfis differs since it is newer and does not employ encryption (all communications are sent through HTTP unencrypted). Nonetheless, Sasfis continues to spread aggressively and typically loads banking trojans among other malicious files.
Additional key threat activities for the month of April include:
Microsoft Vulnerabilities: The Internet Explorer vulnerability MS.IE.Userdata.Behavior.Code.Execution (CVE-2010-0806) was the second-most detected malicious network activity for the second report in a row. While in its zero-day state, Fortinet observed an attack on this vulnerability that installed the infamous Gh0st RAT spy-trojan, a fully-functioning remote administration tool that also streams Webcam video and audio feeds.
Secondly, two memory corruption vulnerabilities in Microsoft Office Visio allow a remote attacker to compromise a system through a malicious document. The vulnerabilities are triggered when opening and rendering a Visio file. A remote attacker could craft a malicious document that exploits either one of these vulnerabilities, allowing them to compromise a system.
Adobe Acrobat vulnerabilities: Two memory corruption vulnerabilities in Adobe Reader / Acrobat, which allow a remote attacker to compromise a system through a malicious document. The vulnerabilities are triggered when opening and rendering a PDF document. A remote attacker could craft a malicious document which exploits either one of these vulnerabilities, allowing them to compromise a system.
Ransomware and scareware still top virus detection: This is no surprise, as scareware has been consistently prevalent since September 2008. Ransomware, on the other hand, began making headway in 2010 due to incentives from affiliate-backed programs that pay out when victims purchase the fake products.
Cutwail spambot leveraged for money mule recruitment: The Cutwail spambot has been active for years, send various spam campaigns for its customers. The spam sent by Cutwail this month typically included malicious links to eCard binaries or emails with the binaries themselves attached. There were various money mule recruitment themes observed in spam emails this report, showing a growing demand for jobs on the black market.