A wave of attacks pushing a new variant of the Pushdo Trojan compromised more than 11,000 systems in just 24 hours, researchers said.
Indian PCs lead in terms of attacks, but systems in the UK, France and the U.S. have also suffered hits, according to security software firm Bitdefender.
As one case in point, the Romanian firm said 77 machines suffered infection in the UK via the botnet in 24 hours, with more than 11,000 infections reported worldwide in the same period. Other countries heavily affected by the Pushdo variant include Vietnam and Turkey.
Bitdefender gets its numbers from traffic toward the sinkholed domains associated with the botnet’s control system.
Traffic to these seized sinkholes came from 11,000 unique IP addresses in a period of 24 hours. These pings represent infected hosts phoning home for instructions.
The most affected region seems to be Asia, with India and Vietnam topping the list of compromised hosts and accounting for around 10 percent of infections each. The U.S. accounts for 5 percent.
“We managed to successfully intercept Pushdo traffic and gain some idea of the size of this botnet,” said Catalin Cosoi, chief security strategist at Bitdefender.
“The sheer scale of this criminal operation, unsophisticated as it may be, is rather troubling and there are indications that the botnet is still in a growth phase. We shall be continuing our investigation as a key priority and further updates shall be made available in the coming days.”
The Pushdo Trojan also distributed secondary malware strains such as ZeuS and SpyEye, but over the years its main use has been for spam distribution. The actual spamming occurs through commonly associated components called Cutwail frequently installed on compromised PCs.
Despite four takedowns in five years against Pushdo command-and-control servers, the botnet endures.
The public and private keys used to protect the communication between the bots and the C&C servers changed with the latest variant, but the communication protocol remains the same.
The latest Pushdo binaries add an encrypted overlay not found in previous versions. If the conditions specified in the overlay are not satisfactory, the sample does not run properly.
The DGA (Domain Generation Algorithm) used by the latest variant has also been slightly revamped. DGAs periodically generate a large number of domain names the zombie hosts can ping for instructions. The approach (pioneered by the infamous Conficker worm) makes life harder for law enforcement. Its successful application in this malware goes a long way toward explaining the resilience of Pushdo.