The spam-spewing Kelihos botnet has returned from the dead.
Microsoft collaborated with Kaspersky Lab to run a successful takedown operation last September. The takedown decapitated the botnet by shutting down command-and-control server nodes, directing the bots on infected computers to contact a server under the control of security researchers, rather than one controlled by the attackers.
In the case of the Kelihos peer-to-peer botnet, Kaspersky researchers pushed out a new peer address, which the existing infected PCs began polling for new instructions.
This "sink-holing" action meant that compromised machines in the network were no longer receiving instruction and spam templates every time they "phoned home" to command nodes. Even so the machines were still infected and left with an open back door that might be exploited by cybercrooks. A deliberate decision was taken NOT to patch infected machines, a problematic process that's illegal in some countries. Instead it was left to users to fix the security on their compromised machines.
Almost inevitably many didn't bother.
Over time miscreants have used the botnet's complex back-channel network of proxy servers to regain control of compromised machines. These machines have been infected with a new variant of Kelihos that uses modified encryption schemes and algorithms to mask communication. Two different keys are being used, suggesting that more than one gang is controlling the botnet, according to a new analysis Maria Garnaeva, a security researcher with Kaspersky Lab.
""As you can see, two different RSA keys are used within a tree which makes us think that probably two different groups are in possession of each key and are currently controlling the botnet," Garnaeva explains.
"Our investigation revealed that the new version appeared as early as September 28, right after Microsoft and Kaspersky Lab announced the neutralisation of the original Hlux/Kelihost botnet," she added.
At its peak, Kelihos spewed out as many as 4 billion junk mail messages, spam-vertised unlicensed pharmaceuticals, stock scams and other tat from around 45,000 malware-infected zombie PCs. Current spam levels are nowhere near this bad, even though they still pose a problem.
The reappearance of spam from the botnet underlines that sinkholing alone is not effective in killing off botnets. Security experts knew this even at the start. Garnaeva suggests that only patching infected machines or taking botnet controllers out of circulation would be truly effective.
Last week Microsoft filed an amended lawsuit alleging that a Russian national was involved in both creating the original Kelihos malware and running the botnet network. Andrey Sabelnikov of St Petersburg, a software developer and former employee at two Russian security firms, denies any wrongdoing. ®