New blood rejuvenates botnet ranks

The growth of new botnets combined with the resurgence of existing networks has helped to push infection numbers higher, according to researchers.

According to the latest report from Symantec's MessageLabs branch, the swelling ranks of malware-controlled computer networks were now responsible for some 87.9 percent of all spam worldwide.

Much of that activity was credited to a resurgence from the Rustock botnet. MessageLabs estimated that the network accounted for ten percent of all spam activity. The total number of machines in the botnet is pegged as high as 1.9 million systems.

Researchers also noted that Rustock has adopted a regular schedule for sending out spam. The spam runs are found to begin each day around 8:00 AM GMT with the first four hours of activity being the busiest. The spam flow continues until roughly 8:00 PM each evening.

Joining Rustock atop the botnet ranks was a new infection known as Maazben. Dealing mainly in Casino-related spam messages, Maazben is believed to be just five months old.

Despite its recent debut, the Maazben network is said to be serving 1.4 percent of total spam loads.

MessageLabs senior intelligence analyst Paul Wood suggested that the closure of ISP's known for harbouring botnet operators has helped takedown older networks, leaving a void in the botnet industry.

"This has undermined the power of the more dominant botnets like Cutwail and cleared the way for new botnets like Maazben to emerge," said Wood.

"However, this won't always be the case as botnet technology has also evolved since the end of 2008 and the most recent ISP closures now have less of an impact on resulting activity as downtime now only lasts a few hours rather than weeks or months as before."