We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Spam ISP McColo re-appears online

US-based provider quickly disconnected again

US ISP MoColo, which had been cut off from the net, made a brief re-appearance over the weekend, security software companies have reported.

McColo, which is thought to host a number of hacking and child pornography sites, was cut off from the internet last week by its upstream providers after an investigation by computer security analysts and the Washington Post.

But McColo came back online on Saturday after connecting with Swedish ISP TeliaSonera, according to Ross Thomas, writing on the blog for security vendor Sophos.

After complaints, TeliaSonera quickly moved to cut off McColo again, Thomas said. But the brief renewal in connectivity did allow cybercriminals running botnets out of McColo's networks to take steps to preserve their operations.

McColo has been identified as hosting the command-and-control servers for no less than five large botnets that are responsible for the majority of the world's spam. When McColo dropped offline, analysts found that spam levels dropped up to 75 percent.

Spam takes a heavy toll on IT infrastructure, consuming bandwidth and potentially exposing users to malicious software.

When McColo came back online, it appeared the hackers who controlled the command-and-control servers for a botnet called Rustock moved the controls for that botnet to a data centre in Russia, according to the blog for security vendor FireEye.

"We believe that the Rustock controllers don't expect McColo to be very stable in the near future, so they are hedging their bets and moving the C&Cs to a different provider," said FireEye.

Those PCs infected with malicious software that enables the computer to be part of the Rustock botnet were also at least partially updated. The update would allow the computers to report to the new Russian command-and-control server to receive orders.

Since McColo was only online for a short period, "there's no way that the whole botnet was updated, but no doubt they got a good-sized piece," FireEye said.

Security analysts have predicted that spam levels will rise again as hackers who used McColo move their operations to other ISPs that are willing to protect spammers and other criminal enterprises, such as those who sells bogus security software or pharmaceuticals.

"Rustock is estimated to be capable of sending 30 billion spams per day," Thomas said.

"How big an increase we'll see depends largely on the number of zombie PCs the botnet's controller was able to reach during McColo's temporary resurrection."


IDG UK Sites

Microsoft Band UK release date and price rumours, features and specs: Microsoft smartwatch unveiled

IDG UK Sites

Why Sony's PS4 2.0 update is every gamer's dream (well, mine at least)

IDG UK Sites

This Grolsch ad combines stop-motion & CG for majestic results

IDG UK Sites

Apple rumours and predictions for 2015: What to expect from Apple in 2015