New variant of Waledac botnet detected

Powered by SC Magazine
 

After the original was taken down two years ago.

A new variant of the Waledac botnet has been detected after the original was taken down two years ago.

At the time a collaboration of companies including Symantec, Microsoft and Shadowserver, and universities in Washington, Mannheim, Vienna and Bonn, took down 277 internet domains believed to be running Waledac.

Tim Cranton, Microsoft's associate general counsel, said at the time that ‘Operation b49' had effectively shut down connections to the vast majority of Waledac-infected computers, but these were still infected with the original malware.

However, research by Palo Alto Networks has revealed that a new variant of the botnet, along with a few modifications, has been detected. The company said its WildFire lag detected Waledac in customer networks in early February.

Rather than just sending spam, as Waledec did in early 2011 with a run of pharmaceutical emails, the new version has upgraded its malicious capabilities to include the stealing of passwords and authentication data.

Palo Alto Networks said: “This includes the ability to sniff user credentials for FTP, POP3 and SMTP and steal .dat files for FTP and BitCoin. All of this information is uploaded to the botnet and would be very valuable for enabling further attacks.

“To avoid confusion it is important to note that this is a new variant of the botnet, and not the original version, which remains under the control of Microsoft.”

Symantec detected this on 8 February and named it ‘W32.Waledac.C'. It said that it is a worm that spreads by sending emails that contain links to copies of itself and opens a backdoor on the compromised computer.

In a blog, Symantec said it has been monitoring the Waledac family for many years and the new variant was sending out spam emails targeted to Russian addresses.

Speaking to SC Magazine, Paul Wood, senior intelligence analyst at Symantec.cloud, said that while the blog doesn't detail the full functionality, this is a credible threat.

Luis Corrons, technical director of PandaLabs, which was heavily involved with the takedown of the Mariposa botnet in 2010, told SC Magazine that this version was probably created by someone with access to the source code.

“If the cyber criminals behind Waledac have not been arrested, it is probably them trying to rebuild their business. Or, as we saw in the Mariposa case, where the real developer of the bot had a number of different customers, this could be a similar case,” he said.

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, UK edition


New variant of Waledac botnet detected
 
 
 
Top Stories
The CISO’s dilemma: Do you trust your partner’s partner?
[Blog post] How far down the chain do you check?
 
Microsoft confirms Australian Azure launch
Available from next week.
 
NBN Co names first 140 FTTN sites
National trial extended.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  11%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 289

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  60%
 
No
  40%
TOTAL VOTES: 106

Vote