World’s worst botnet fiends switch from ransomware to stock scam spam
By Prempal Singh
Cybercriminals behind the Necurs botnet have reactivated the living dead network and returned to their original business of using compromised machines as the canal for spam distribution.
In January, Cisco Talos reported that the Necurs botnet had gone offline, taking the typical volume of Locky ransomware-tainted spam email messages with it.
Security experts have once again recognized an uptick of trash email from the Necurs botnet over recent times. Rather than distributing adware and spyware by means of malicious attachments, it has shifted back to sending high volumes of penny stock pump-and-dump communications.
Necurs was abused to operate a similar campaign in December 2016, shortly before the botnet went off-line for a long period. “This strategic divergence from the distribution of malware may be indicative of a change in the way that attackers are trying to economically leverage this botnet, ” according to Cisco Talos.
An entire evaluation of this Necurs activity can be found in a blog post by Cisco Talos here. Necurs is reckoned to be the greatest spam botnet in the world, so changes in its behavior can have a large impact on the type and volume of junk striking inboxes.
Source: theregister.co.uk