New Botnet on the Loose

Filed in archive Spam on February 29, 2008

A new peer to peer botnet is on the scene, and it's even more powerful than Storm. It's begun attacking U.S. based enterprises, educational institutions and ISPs. Named the MayDay botnet, it's able to evade most anti-virus products. To communicate with it's bots it uses several techniques, including browser hijacking. It's delivered to unsuspecting users in the forum of a adobe reader exe file. MayDay is nowhere near as large as Storm but could do more damage because of it's more sophisticated methods.
"MayDay is unique because it has the ability to communicate from within the inside of the enterprise," says Tripp Cox, vice president of engineering for Damballa.. "It's powerful in the damage it could do when orchestrated for a common purpose. It could potentially be more powerful because of the types of networks it's successfully compromised."
So far the bot is limited to sending spam runs and accounting information on the success of said runs to it's command servers.