Last year security vendors were warning that botnets were not only not dead, but bouncing back in a big way. One suggested that botnets would become autonomous and intelligent, with each node containing inbuilt self-sufficient coding in order to coordinate and extend its own survival, during the course of 2010.
Now we are nearly half way through the year, it seems that prediction was pretty much spot on. Certainly the latest Threatscape report from Fortinet would suggest that botnets are alive and well, with multiple botnets showing a worrying level of high activity.
While Gumblar remained in the No. 1 position in Fortinet’s Top 10 Network Attacks list, the Sasfis botnet ranking was bolstered by two of its executables prevalent in Fortinet’s Antivirus Top 10 listing. Like Bredolab, Sasfis is a botnet loader that reports statistics and retrieves/executes files upon check-in. However, Sasfis differs since it is newer and does not employ encryption (all communications are sent through HTTP unencrypted). Nonetheless, Sasfis continues to spread aggressively and typically loads banking trojans among other malicious files.
Additional key threat activities for the month of April include:
Microsoft Vulnerabilities
The Internet Explorer vulnerability MS.IE.Userdata.Behavior.Code.Execution (CVE-2010-0806) was the second-most detected malicious network activity for the second report in a row. While in its zero-day state, Fortinet observed an attack on this vulnerability that installed the infamous Gh0st RAT spy-trojan, a fully-functioning remote administration tool that also streams Webcam video and audio feeds. Secondly, FortiGuard Labs also discovered two memory corruption vulnerabilities in Microsoft Office Visio that allow a remote attacker to compromise a system through a malicious document. The vulnerabilities are triggered when opening and rendering a Visio file. A remote attacker could craft a malicious document that exploits either one of these vulnerabilities, allowing them to compromise a system.
Adobe Acrobat vulnerabilities
Fortinet’s FortiGuard Labs also discovered two memory corruption vulnerabilities in Adobe Reader / Acrobat, which allow a remote attacker to compromise a system through a malicious document. The vulnerabilities are triggered when opening and rendering a PDF document. A remote attacker could craft a malicious document which exploits either one of these vulnerabilities, allowing them to compromise a system.
Ransomware and Scareware still top virus detection
This is no surprise, as Scareware has been consistently prevalent since September 2008. Ransomware, on the other hand, began making headway in 2010 due to incentives from affiliate-backed programs that pay out when victims purchase the fake products.
Cutwail spambot leveraged for money mule recruitment
Fortinet continues to observe the Cutwail spambot, which has been active for years, send various spam campaigns for its customers. The spam sent by Cutwail this month typically included malicious links to eCard binaries or emails with the binaries themselves attached. There were various money mule recruitment themes observed in spam emails this report, showing a growing demand for jobs on the black market.
