Grum Botnet Axed; Global Spam Cut in Half

An international security campaign has taken down Grum, a hacker-controlled botnet responsible for the daily release of 18 billion spam emails.

The takedown effort began two weeks ago, when authorities in the Netherlands pulled the plug on Grum's two main servers. Other servers in Panama went offline earlier this week. Grum's last servers were disconnected in Russia, effectively killing the botnet.

Group Effort Stops Grum

The demise of the Grum botnet was confirmed by security vendor FireEye in a recent blog post. Grum's termination apparently resulted from a group effort.

To kill the offending network, FireEye security researcher Atif Mushtaq teamed up with spam monitoring specialist Spamhaus, various Internet Service Providers (ISPs), and several other research teams around the globe. (Source: itpro.co.uk)

According to Spamhaus' figures, Grum used an average of 120,000 Internet Protocol (IP) addresses to distribute its emails. As soon as Grum's servers were shut down, this figure dropped to 21,505.

According to Mushtaq, since the complete destruction of the Grum botnet the total amount of spam in the world has been cut in half.

Because of these impressive numbers, observers expect the spam fighters' success to chill remaining Russian and Ukrainian spam operations, which can no longer assume these countries offer cybercriminals a safe haven.

With security researchers watching them from around the world, online offenders now must deal with far more adversaries than ever before. "That will have a huge impact on the mindset of bot herders," Mushtaq said. (Source: pcworld.com)

Thousands of Infected Computers Inactive

The Grum botnet's death leaves tens of thousands of malware-infected computers inactive. Without the network's original master computer and the IP addresses of the infected computers, the botnet is unlikely to be resurrected.

"There's no way to hijack this botnet," Mushtaq said. "[Its computers] are lost to us and to bot herders."