Pushdo Trojan outbreak: 11 THOUSAND systems infected in just 24 hours

Just 77 machines in the UK, though

A wave of attacks by cybercrooks pushing a new variant of the resilient Pushdo Trojan has compromised more than 11,000 systems in just 24 hours.

Indian PCs have been most affected by the outbreak, but systems in the UK, France and the US have also been hit, according to security software firm Bitdefender.

The Romanian firm reckons 77 machines have been infected in the UK via the botnet in the past 24 hours, with more than 11,000 infections reported worldwide in the same period. Other countries that have been heavily affected by the Pushdo variant include Vietnam and Turkey.

Bitdefender figures come from traffic towards the sinkholed domains associated with the botnet's control system.

Traffic to these seized sinkholes came from 11,000 unique IP addresses in a period of 24 hours. These pings represent infected hosts phoning home for instructions.

The most affected region seems to be Asia, with India and Vietnam topping the list of compromised hosts and accounting for around 10 per cent of infections each. The US accounts for another 5 per cent of the total.

“We managed to successfully intercept Pushdo traffic and gain some idea of the size of this botnet,” states Catalin Cosoi, chief security strategist at Bitdefender.

“The sheer scale of this criminal operation, unsophisticated as it may be, is rather troubling and there are indications that the botnet is still in a growth phase. We shall be continuing our investigation as a key priority and further updates shall be made available in the coming days.”

The Pushdo Trojan has been used to distribute secondary malware strains such as ZeuS and SpyEye, but over the years its main use has been geared towards spam distribution. The actually spamming is done through a commonly associated components called Cutwail that are frequently installed on compromised PCs.

Despite four takedowns in five years against Pushdo command-and-control servers, the botnet endures.

The public and private keys used to protect the communication between the bots and the C&C servers have been changed with the latest variant, but the communication protocol remains the same.

The latest Pushdo binaries add an encrypted overlay not found in previous versions. If the conditions specified in the overlay are not met, the sample does not run properly.

The DGA (Domain Generation Algorithm) used by the latest variant has also been slightly revamped. DGAs are used to periodically generate a large number of domain names the zombie hosts can ping for instructions. The approach (pioneered by the infamous Conficker worm) makes life harder for law enforcement. Its successful application in this malware goes a long way towards explaining the resilience of Pushdo. ®