Forseveral years before July 2012 takedown, Grum was one of the notorious spambotnets and at one time was responsible for more than 30% of spamworldwide. Last year's Grum botnet takedown was a victorious feat by the securitycommunity and could be considered as one of the most significant takedowns of2012. However, the effect of this takedown seems to be temporary as we've observedspam volume from Grum bot trickling back:
The usual setof command which is basically a HTTP GET request at port 80 can be observedwhen it communicates to its C&C server.
GET /spm/s_get_host.php?ver=[bot version]
s_get_host.php - get theinfected machine's IP address and hostname
GET /spm/s_alive.php?id=[botmachineid]&tick=[system tick]&ver=[bot version]&smtp=[ok|bad]
s_alive.php - reports backto the control server that the bot is alive. The data includes bot id, systemtick,bot version and smtp status to control server
GET /spm/s_task.php?id=[bot machineid]&tid=xxxxx
s_task.php - get task andspam templates.
GET /spm/s_report.php?task=[task id]&id=[botmachine id]&errors[xxx]=xx
s_report.php - reports backerrors to the command and control server.
The spamming began rightafter it received the encrypted spam template:
The spam campaigns fromGrum were the usual suspect: pharmaceutical spam. The link in the spam points to an illegalpharmacy website operation. I've alsolisted the Russian domains related to this spam campaign, here.
The spam volume from Grumthat we are seeing today is a pale shadow of what it was before the July 2012takedown. But it is worth noting that Grum is showing a slow come back. Perhapsbot herders behind Grum botnet are slowly rebuilding it again. We've beeninvolved in helping various botnet takedowns before, but most of the time, theeffect is temporary. It seems this botnet is deeply rooted, that you couldn't take it down by its branch and fruit, but by its roots.
Trustwave Secure Email Gateway customers are protected against this spam campaign.