Microsoft: Kelihos botnet still down, new one emerging

Microsoft says the 41,000-strong Kelihos botnet it knocked out last year is still out of action, but clarified a new one is being developed using similar code.

Microsoft issued a statement last Friday clarifying confusion after Kaspersky Lab published a report, which noted the limitations to ending a botnet's life by disrupting and seizing its command infrastructure, as Microsoft, Kaspersky and Kyrus Tech had last September.

Commenting on the emergence of the emergence of a Kelihos bot, Kaspersky Lab researcher Maria Garnaeva wrote that its role in the take down, which focussed on "sinkholing" the botnet's traffic after its domain names were seized, was good at disrupting an operation but not effective if the bot masters were still at large.

Microsoft may have found at least one of the people in such a position after naming Russian software developer Andrey Sabelnikov as the maker of Kelihos -- an allegation he has denied and says he will fight.

Garnaeva also said it was "impossible to neutralise a botnet by taking control over the controller machines or substituting the controller list without any additional actions" since a botnet master could, if they knew the list of active router IPs, regain control of the network with a bot update.

Microsoft's Digital Crimes Unit senior attorney Richard Boscovich confirmed it had evidence of a new botnet, consisting of very similar code to the old Kelihos.

However, he added that "this does not mean that the Kelihos botnet we took down is back in operation, but that a new version of Kelihos malware known as ‘Backdoor: Wion32/Kelihos.B’ is being used to create a new botnet."

Since the take down of the first Kelihos botnet, Microsoft's Malicious Software Removal Tool (MSRT) -- which removes "actively running" viruses, worms and Trojans, but not dormant malware -- has removed Kelihos from 28,000 of the estimated 41,000 machines running the original bot.

Boscovich estimated the current size of the botnet's infected fleet to be less than 10,000, but could not give any estimate for the size of the new one.

The botnet was used to send spam, harvest user information and promote illegal websites, such as sites containing child exploitation material as well as counterfeit pharmaceuticals.

Follow @CSO_Australia