CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

Kelihos is Dead… No wait… Long Live Kelihos! Again!

This post is inspired by a news article which highlighted a recent presentation at RSA. Kelihos, for those that don't know, is a spamming botnet. For the last few years it has been around in some form or another, but its spam output has not been nearly as large as some of the other botnets we regularly talk about, like Cutwail or Lethic.

Anyway, the article is entitled Latest Kelihos Botnet Shut Down Live at RSA Conference 2013. Wow! Cool! A Live Takedown! "But then again", I thought, "that would the third time this particular botnet has supposedly been taken down". So I went over to check our spam traps for evidence of the effect.

And here is what was found, huge amounts of stock 'pump & dump' spam:


Ironically, in spite of this spectacular takedown (or perhaps because of it?), spam output from Kelihos has jumped upwards to spectacular levels. Below is a chart showing the Kelihos spam levels in a daily spam sample over the past three months. Clearly someone has got a whole bunch more bots from somewhere! You can see however a slight dip around 26 February – shown by the arrow – on the day of the live takedown presentation.


So this increase is significant indeed. Today spam from Kelihos bots is making up over 50% of the total spam arriving at our spam traps. That's a big deal. Just to make sure we weren't confusing it with something else, we ran some recent Kelihos malware samples in our lab. Sure enough, classic Kelihos pump & dump as evidenced by this template we extracted from the set of instructions the bot received prior to spamming:


The template matches exactly what we see in our spam traps. We won't go into too much more here, others have recently provided some excellent insight into Kelihos; Lavasoft in particular has a very detailed analysis here.

In the past, there have been numerous much-publicized attempts to takedown Kelihos, and its predecessors, Storm and Waledac. For some reason, it always gets a lot of attention by researchers, probably because its peer-to-peer nature is both interesting, and lends itself to such interference.

But, despite such efforts, Kelihos and its code persists. Each time it merely morphs into something else. It goes to show that botnet takedowns may be flashy, but unless you arrest the people running it, or otherwise hamstring them somehow, the chances of a long term effect are minimal. And even if you do arrest people, code persists, and can be reused by someone else. These days, it's also easy for botnet operators to build their bot numbers again through the use of third-party loaders, or pay-per-install programs, where the criminals simply pay someone else to load their malware onto a bunch of already compromised machines. Symantec recently blogged about this sort of relationship: Waledac Gets Cozy with Virut. In fact, we have been observing Virut loading spambots for years, here is an M86 Security blog from 2009: Virut's Not So Obvious Motive.

So taking down botnets is not simple or easy. It's not to say I don't applaud such efforts. On the contrary, hamper them any way you can, I reckon. Just don't always expect long lasting results.

Thanks to my SpiderLabs colleague Rodel Mendrez for his research and input into this blog.

Latest SpiderLabs Blogs

EDR – The Multi-Tool of Security Defenses

This is Part 8 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The full series can be found here.

Read More

The Invisible Battleground: Essentials of EASM

Know your enemy – inside and out. External Attack Surface Management tools are an effective way to understand externally facing threats and help plan cyber defenses accordingly. Let’s discuss what...

Read More

Fake Dialog Boxes to Make Malware More Convincing

Let’s explore how SpiderLabs created and incorporated user prompts, specifically Windows dialog boxes into its malware loader to make it more convincing to phishing targets during a Red Team...

Read More