Botnets crawl back after McColo shutdown

Mega-D botnet creators have set up new command and control servers and re-established their connections with bots just three weeks after the closure of spam hosting provider, Mccolo.

According to Marshal8e6's TRACElabs, the spammers have restored the affected connections and Mega-D, which was one of three major global botnets shut down, is now back spamming again.

US-based web-hosting firm McColo was shutdown by its ISP on November 11 following a journalist’s enquiries about illicit spam activities. The volume of spam has doubled since the low point immediately following the McColo shutdown, Marshal8e6 has reported.

“Spam from Mega-D has been ramping up over the last few days and reached up to 48 percent of all the spam we captured in our honeypot spam traps,” said Phil Hay, lead threat analyst for the Marshal8e6 TRACElabs.

However, the security vendor claimed the botnet no longer exhibits some of its previously distinctive characteristics.

“The Mega-D bots appear to have been upgraded and altered quite substantially by the people behind it. It now uses templates we have seen before with Rustock. This is an interesting development.

“It could mean that the Mega-D spammers have looked at and copied from their rivals. Or, it could indicate that the individuals behind both botnets are working in collusion or are one in the same. This is something that we will explore further,” said Hay.

afterbackbotnetsmccolosecurityshutdown