Menu
Asprox botnet, a long-running nuisance, disappears

Asprox botnet, a long-running nuisance, disappears

Asprox's operators may be regrouping to evade detection, according to Palo Alto Networks

Asprox, a long-running botnet that sent spam spoofing major brands to distribute malware, has shut down.

Asprox, a long-running botnet that sent spam spoofing major brands to distribute malware, has shut down.

The Asprox botnet, whose malware-spamming activities have been followed for years by security researchers, appears to be gone.

Since 2007, the botnet was used for effective spam campaigns that sought to trick people into downloading malware attachments in emails that purported to be court notices or notifications from services including FedEx, the U.S. Postal Service and American Airlines.

But by January, the botnet seemed to be shut down, wrote Ryan Olson, intelligence director for Palo Alto Networks, in a blog post. Throughout 2014, the security company noticed the botnet was distributing Kuluoz, a malware program linked to Asprox.

"As weeks turned into months, we found that Kuluoz didn't return," he wrote.

Olson wrote that Palo Alto thought the botnet's operators may have changed their tactics, and Palo Alto missed the shift. But they verified that Asprox's command-and-control structure shut down -- at least for now.

"We've not yet seen any indication that the individuals behind these attacks have been arrested or forced to stop operating, so it's likely that they've shut down this botnet to regroup and redeploy after they've found ways to evade the detections deployed by the security industry," Olson wrote. "After all, sending 80 percent of all malware puts you pretty high on everyone's list of priorities."

Earlier this year, Brad Duncan, a security researcher at Rackspace, also noticed a change: spam that appeared stylistically close to that sent by Asprox had different malware.

Asprox has taken a hit before. In November 2008, it was one of several botnets affected by the shutdown of McColo, a notorious California-based ISP that was providing network connectivity for cybercriminals. The shutdown of McColo dramatically cut the amount of spam, but Asprox as well as other botnets came back.

The most frequently malware now seen by Palo Alto is Upatre. That malware downloads other harmful programs to a computer, and Palo Alto has seen it involved in installing a banking trojan called Dyre and the Cryptowall ransomware, which encrypts files on a computer and demands a payment for the decryption key.

Upatre is "not nearly as prevalent as Kuluoz, but it's certainly making an impression," Olson wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or
Error: Please check your email address.

Tags securitymalwarepalo alto networks

Featured

Slideshows

Bumper channel crowd kicks off first After Hours of 2018

Bumper channel crowd kicks off first After Hours of 2018

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Jefferson in Auckland to kick-start 2018. Photos by Gino Demeer.

Bumper channel crowd kicks off first After Hours of 2018
Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Show Comments