Category Archives: Necurs

Security Affairs: Necurs botnet is behind seasonal campaigns of Valentine’s Day-themed spam

Necurs botnet made headline again, the experts at IBM X-Force research team observed a spike in seasonal campaigns of Valentine’s Day-themed spam emails.

Necurs botnet made headline again, the experts at IBM X-Force research team observed a spike in the activity of the infamous botnet.

Necurs was not active for a long period at the beginning of 2017 and resumed it activity in April 2017. The Necurs botnet was used in the past months to push many other malware, including LockyJaffGlobeImposterDridex , Scarab and the Trickbot.

Scammers are mow using the Necurs botnet to send out an amazing number of messages offering companionship waiting for Valentine’s day.

Crooks are using the spam messages to trick victims into sharing personal photos that are used later by cybercriminals to blackmail the victims.

According to the IBM X-Force team, the campaign started in mid-January, it leverages the overall Necurs botnet that is composed of 6 million bots.

“The current campaign from Necurs reached over 230 million spam messages within a matter of two weeks as the botnet spewed tens of millions of messages in two major bouts. The first surge started on Jan. 16 and ran through Jan. 18; the second started on Jan. 27 and died down on Feb. 3.” reads the analysis published by X-Force researchers.

The expert spotted two current campaigns that sent out a total 230 million spam messages in 14 days-period.

necurs spammers valentines day

 

The first campaign reached a peak between Jan. 16 and Jan. 18 and the second one began on Jan. 27 and lasted through Feb. 3. Researchers observed an average 30 million spam messages were sent each day.

“Looking at the messages being sent out in excess of 30 million emails a day, the current campaign delivers short email blurbs from supposed Russian women living in the U.S. While typical spam email is notorious for bad spelling and grammar, these samples are rather well-worded.” continues the analysis.”

The experts determined that the spam messages are being sent from about 950,000 unique IP addresses, Most of IP are hosted in Vietnam and India while the top sender IP address is hosted via a Pakistani-based ISP.

“Together, Vietnam and India hosted 55 percent of the IPs from which the spam originated. It’s worth noting that spammers constantly shuffle the resources they leverage and the originating IPs logged in one campaign are not likely to be used in the next one. This is how fraudsters avoid blacklists and blocking.” added the researchers.

After the takedowns of the Andromeda and Avalanche botnets, Necurs remains the largest spam distributor in the cybercrime ecosystem. Crooks will continue to leverage the Necurs botnet for their spam campaigns, for this reason, the most effective countermeasure is to increase employee awareness on such kind of threats.

 

Pierluigi Paganini

(Security Affairs – Necurs botnet, Valentine’s Day)

The post Necurs botnet is behind seasonal campaigns of Valentine’s Day-themed spam appeared first on Security Affairs.



Security Affairs

Necurs botnet is behind seasonal campaigns of Valentine’s Day-themed spam

Necurs botnet made headline again, the experts at IBM X-Force research team observed a spike in seasonal campaigns of Valentine’s Day-themed spam emails.

Necurs botnet made headline again, the experts at IBM X-Force research team observed a spike in the activity of the infamous botnet.

Necurs was not active for a long period at the beginning of 2017 and resumed it activity in April 2017. The Necurs botnet was used in the past months to push many other malware, including LockyJaffGlobeImposterDridex , Scarab and the Trickbot.

Scammers are mow using the Necurs botnet to send out an amazing number of messages offering companionship waiting for Valentine’s day.

Crooks are using the spam messages to trick victims into sharing personal photos that are used later by cybercriminals to blackmail the victims.

According to the IBM X-Force team, the campaign started in mid-January, it leverages the overall Necurs botnet that is composed of 6 million bots.

“The current campaign from Necurs reached over 230 million spam messages within a matter of two weeks as the botnet spewed tens of millions of messages in two major bouts. The first surge started on Jan. 16 and ran through Jan. 18; the second started on Jan. 27 and died down on Feb. 3.” reads the analysis published by X-Force researchers.

The expert spotted two current campaigns that sent out a total 230 million spam messages in 14 days-period.

necurs spammers valentines day

 

The first campaign reached a peak between Jan. 16 and Jan. 18 and the second one began on Jan. 27 and lasted through Feb. 3. Researchers observed an average 30 million spam messages were sent each day.

“Looking at the messages being sent out in excess of 30 million emails a day, the current campaign delivers short email blurbs from supposed Russian women living in the U.S. While typical spam email is notorious for bad spelling and grammar, these samples are rather well-worded.” continues the analysis.”

The experts determined that the spam messages are being sent from about 950,000 unique IP addresses, Most of IP are hosted in Vietnam and India while the top sender IP address is hosted via a Pakistani-based ISP.

“Together, Vietnam and India hosted 55 percent of the IPs from which the spam originated. It’s worth noting that spammers constantly shuffle the resources they leverage and the originating IPs logged in one campaign are not likely to be used in the next one. This is how fraudsters avoid blacklists and blocking.” added the researchers.

After the takedowns of the Andromeda and Avalanche botnets, Necurs remains the largest spam distributor in the cybercrime ecosystem. Crooks will continue to leverage the Necurs botnet for their spam campaigns, for this reason, the most effective countermeasure is to increase employee awareness on such kind of threats.

 

Pierluigi Paganini

(Security Affairs – Necurs botnet, Valentine’s Day)

The post Necurs botnet is behind seasonal campaigns of Valentine’s Day-themed spam appeared first on Security Affairs.

Necurs Spammers Go All In to Find a Valentine’s Day Victim

Love is in the air — or, in this case, your spam folder. IBM X-Force observed a massive uptick from the Necurs botnet that is focused on dating spam. It started in mid-January 2018 and will continue as Valentine’s Day draws near.

The Necurs botnet is notorious for its massive spam campaigns and is believed to control up to 6 million zombie bots. This botnet is best known for its ties to malware gangs that spread banking Trojans, such as Dridex and TrickBot, and ransomware such as Locky, Scarab and Jaff.

But Necurs is not only about malware. Its operators dabble in distributing spam for other fraud endeavors as well, which brings to light this recent romance scam campaign.

In 2017, X-Force observed Necurs sending mass amounts of pump-and-dump stock scams designed to make recipients believe a penny stock was about to rise in value. Once enough people buy the stock and it actually rises in value, the scammers sell off their shares to make a profit. The penny stock then drops back to its real market value, and those who bought it are often left with nothing but losses. In early 2018, the botnet was part of large cryptocurrency scams, and this latest bout of dating spam is yet another major campaign linking Necurs to shady online activity.

Massive Spam in Season

Preying on seasonal trends is probably the top characteristic of email spam. The first quarter of the year typically plagues email recipients with tax season spam and romance scams that start arriving in January leading up to Valentine’s Day.

The current campaign from Necurs reached over 230 million spam messages within a matter of two weeks as the botnet spewed tens of millions of messages in two major bouts. The first surge started on Jan. 16 and ran through Jan. 18; the second started on Jan. 27 and died down on Feb. 3.

IBM X-Force ResearchFigure 1: Spam volumes recorded since Jan. 1 with peaks of Necurs-generated spam (Source: IBM X-Force)

Convincing Correspondence

Looking at the messages being sent out in excess of 30 million emails a day, the current campaign delivers short email blurbs from supposed Russian women living in the U.S. While typical spam email is notorious for bad spelling and grammar, these samples are rather well-worded.

Each spam message comes from a disposable email address carrying the alleged writer’s name, but then asks the recipient to contact the writer back using another email address associated with another person’s name.

IBM X-Force Research

IBM X-Force Research

Necurs botnet romance scam spam

Figure 2: Screen captures of email samples spewed by Necurs botnet in its dating spam campaign (Source: IBM X-Force)

Many of the messages indicated that the recipient had a profile on Facebook or Badoo, a dating-focused social network founded in 2006 by Russian entrepreneur Andrey Andreev. Badoo is the third most popular dating app in Russia, but it is also available internationally.

Spam featuring messages from supposedly interested women is an old ploy. Such emails usually feature nothing more than basic text and are not likely to lure many people in. However, when it comes to spam, mass volume makes for a numbers game, and fraudsters only need a small percentage of recipients to reply. The threat actors behind this campaign will likely lure their victims to share revealing photos and extort them, ask for money to come visit or simply infect them with malware.

Learn how to mitigate malware in a modern, mobile world

Necurs’ Spamming Power

Overall, X-Force recorded over 230 million dating spam emails from the Necurs botnet, suggesting a capacity to distribute very large amounts of junk email. The spam was sent from roughly 950,000 different IP addresses. The top sender on the IP list was an address hosted via a Pakistani-based ISP. That IP address (103.255.5.117) had been reported as a spammer 655 times at the time of this writing and the IBM X-Force Exchange set its risk level at 10, the highest possible score.

Together, Vietnam and India hosted 55 percent of the IPs from which the spam originated. It’s worth noting that spammers constantly shuffle the resources they leverage and the originating IPs logged in one campaign are not likely to be used in the next one. This is how fraudsters avoid blacklists and blocking.

Necurs Botnet romance scams

Figure 3: Top sending countries in Necurs dating spam campaign (Source: IBM X-Force)

After the recent takedowns of the Andromeda and Avalanche botnets, Necurs is probably the largest spam distributor serving cybercriminals at this time. According to X-Force’s ongoing monitoring of Necurs’ activity, the botnet’s established status in the cybercrime world attracts both lower-grade spammers and elite gangs seeking to spread their malware.

Say No to Spam

The operators of Necurs and other botnets have one goal: to get spam messages into people’s mailboxes without being filtered or blocked. These botnets often shuffle their methods, changing up the types of spam they spread and devising new ways to conceal it in varying file types and email ploys. As a result, spam from Necurs could find its way into both consumer and employee mailboxes. The best way to thwart these scams is to increase employee awareness about the types of malicious emails they should never open or respond to.

For more tips to avoid spammers’ bait, read our malware mitigation tips article.

The post Necurs Spammers Go All In to Find a Valentine’s Day Victim appeared first on Security Intelligence.