As spam declined after Rustock botnet’s death malicious email grows rapidly

Since March when Microsoft in association with the U.S. Federal Marshal service and security firm FireEye shut down the Rustock botnet the number of email messages with malicious links increased significantly. While the shutdown resulted in a sharp decline of spam messages it provoked great lack of zombie machines thus prompting perpetrators to send more malicious messages.

"Whether they are the Rustock group trying to rebuild or they are rivals to Rustock who are trying to take on the demand that was there previously" is uncertain, says Paul Wood, senior analyst with Symantec.cloud, the online security service arm of Symantec. "Obviously they have customers that wanted to send their spam messages and they can't, so they will be looking to rival providers."

Security firms Symantec and Commtouch noted that malicious email traffic had increased. Symantec reported that one out of every 169 emails carried a malicious link or attachment, an 24% rise since March.

Meantime, Commtouch saw a spike in the amount of malicious e-mail in late March and early April. Last week the company noted a 71% growth in the number of zombies since March.

The Rustock botnet, which consists of some 1 million compromised PCs, was capable of sending up to 30 billion spam messages per day. Spam dropped by nearly a third following the takedown, which Microsoft accomplished by convincing a judge to issue a restraining order letting the company seize the servers used to control the botnet. Those servers were hosted in facilities in seven U.S. cities.