Menu
Asprox botnet, a long-running nuisance, disappears

Asprox botnet, a long-running nuisance, disappears

Asprox's operators may be regrouping to evade detection, according to Palo Alto Networks

Asprox, a long-running botnet that sent spam spoofing major brands to distribute malware, has shut down.

Asprox, a long-running botnet that sent spam spoofing major brands to distribute malware, has shut down.

The Asprox botnet, whose malware-spamming activities have been followed for years by security researchers, appears to be gone.

Since 2007, the botnet was used for effective spam campaigns that sought to trick people into downloading malware attachments in emails that purported to be court notices or notifications from services including FedEx, the U.S. Postal Service and American Airlines.

But by January, the botnet seemed to be shut down, wrote Ryan Olson, intelligence director for Palo Alto Networks, in a blog post. Throughout 2014, the security company noticed the botnet was distributing Kuluoz, a malware program linked to Asprox.

"As weeks turned into months, we found that Kuluoz didn't return," he wrote.

Olson wrote that Palo Alto thought the botnet's operators may have changed their tactics, and Palo Alto missed the shift. But they verified that Asprox's command-and-control structure shut down -- at least for now.

"We've not yet seen any indication that the individuals behind these attacks have been arrested or forced to stop operating, so it's likely that they've shut down this botnet to regroup and redeploy after they've found ways to evade the detections deployed by the security industry," Olson wrote. "After all, sending 80 percent of all malware puts you pretty high on everyone's list of priorities."

Earlier this year, Brad Duncan, a security researcher at Rackspace, also noticed a change: spam that appeared stylistically close to that sent by Asprox had different malware.

Asprox has taken a hit before. In November 2008, it was one of several botnets affected by the shutdown of McColo, a notorious California-based ISP that was providing network connectivity for cybercriminals. The shutdown of McColo dramatically cut the amount of spam, but Asprox as well as other botnets came back.

The most frequently malware now seen by Palo Alto is Upatre. That malware downloads other harmful programs to a computer, and Palo Alto has seen it involved in installing a banking trojan called Dyre and the Cryptowall ransomware, which encrypts files on a computer and demands a payment for the decryption key.

Upatre is "not nearly as prevalent as Kuluoz, but it's certainly making an impression," Olson wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags palo alto networkssecuritymalware

Featured

Slideshows

A snapshot of the Kiwi partners set to shine at the Reseller News Awards

A snapshot of the Kiwi partners set to shine at the Reseller News Awards

With the 2017 Reseller News ICT Industry Awards only weeks away, Reseller News profiles the power line-up of partners set to dominate the biggest night on the channel calendar. ​Ranging from the enterprise, down through the mid-market and small business sectors into the heart of the start-up scene, the end result is the most diverse and wide-ranging partner line-up in the history of the Awards, playing host to the leading innovators of the past 12 months.​

A snapshot of the Kiwi partners set to shine at the Reseller News Awards
Channel celebrates as HP marks 50 years in NZ

Channel celebrates as HP marks 50 years in NZ

HP marked 50 years in New Zealand at an event in the vendor's Auckland's headquarters last night, with a host of key channel figures coming along to celebrate. Photos by HP.

Channel celebrates as HP marks 50 years in NZ
Show Comments