New variant of Waledac botnet detected

Powered by SC Magazine
 

After the original was taken down two years ago.

A new variant of the Waledac botnet has been detected after the original was taken down two years ago.

At the time a collaboration of companies including Symantec, Microsoft and Shadowserver, and universities in Washington, Mannheim, Vienna and Bonn, took down 277 internet domains believed to be running Waledac.

Tim Cranton, Microsoft's associate general counsel, said at the time that ‘Operation b49' had effectively shut down connections to the vast majority of Waledac-infected computers, but these were still infected with the original malware.

However, research by Palo Alto Networks has revealed that a new variant of the botnet, along with a few modifications, has been detected. The company said its WildFire lag detected Waledac in customer networks in early February.

Rather than just sending spam, as Waledec did in early 2011 with a run of pharmaceutical emails, the new version has upgraded its malicious capabilities to include the stealing of passwords and authentication data.

Palo Alto Networks said: “This includes the ability to sniff user credentials for FTP, POP3 and SMTP and steal .dat files for FTP and BitCoin. All of this information is uploaded to the botnet and would be very valuable for enabling further attacks.

“To avoid confusion it is important to note that this is a new variant of the botnet, and not the original version, which remains under the control of Microsoft.”

Symantec detected this on 8 February and named it ‘W32.Waledac.C'. It said that it is a worm that spreads by sending emails that contain links to copies of itself and opens a backdoor on the compromised computer.

In a blog, Symantec said it has been monitoring the Waledac family for many years and the new variant was sending out spam emails targeted to Russian addresses.

Speaking to SC Magazine, Paul Wood, senior intelligence analyst at Symantec.cloud, said that while the blog doesn't detail the full functionality, this is a credible threat.

Luis Corrons, technical director of PandaLabs, which was heavily involved with the takedown of the Mariposa botnet in 2010, told SC Magazine that this version was probably created by someone with access to the source code.

“If the cyber criminals behind Waledac have not been arrested, it is probably them trying to rebuild their business. Or, as we saw in the Mariposa case, where the real developer of the bot had a number of different customers, this could be a similar case,” he said.

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, UK edition


New variant of Waledac botnet detected
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 440

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 211

Vote