Kraken Botnet Resurfaces

According to Paul Royal Research Scientist at GTISC (Georgia Tech Information Security Center) a major establishment for studying botnets, a large botnet named 'Kraken' that could not be detected during 2008 is resurfacing following its effective dismantling during 2009, as reported by CNet on June 25, 2010.

Kraken has still now brought over 318,000 computers under its control. Earlier, when it compromised the maximum number of PCs, the figure stood at 650,000 in 2008, reports Royal.

The researcher further reports that the most recent form of Kraken chiefly distributes spam mails concentrating on advertisements touting erectile dysfunction and male enhancement drugs. Moreover, the botnet works in an extraordinary manner. It was found that a lone compromised PC having a Digital Subscriber Line (DSL) connection sent over 600,000 spam mails within just 24 hours.

Royal states that the latest version of Kraken is normally deployed with the help of another botnet using the Butterfly bot malware. According to the expert, while it isn't fully known if for installing Kraken, the same gang of criminals is involved as the one that handles the botnet's operations. The network actually may represent an instance where skilled criminal gangs are putting a joint effort towards accomplishing the tasks, as reported by Honeynet.it on June 25, 2010.

Royal observes that a lot of widely used antivirus solutions are unable to recognize Kraken. Indeed, a VirusTotal scrutiny shows that all the 3 AV tools that VirusTotal adjudged as the best are unable to spot present Kraken samples.

Prior to this botnet's dismantling during 2009, the security company 'Damballa' had discovered that Kraken resembled the Storm Trojan and other botnets in a number of ways. Accordingly, Kraken too utilizes encrypted communications and can shift the command-and-control feature across the botnet whenever necessary.

Like the majority of botnets, the Kraken botnet sought to propagate immense volumes of spam. Security officials at Damballa pointed out during April 2008 that they had observed single systems pushing out up to 500,000 junk e-mails during just one day.

» SPAMfighter News - 7/7/2010