Kelihos Botnet Thrives, Despite Takedowns

Nov 13, 2013 (08:11 AM EST)

Read the Original Article at

Is the Kelihos botnet going bust?

Kaspersky Lab on Tuesday published research showing that its sinkholing of one version of the Kelihos (a.k.a., Hlux) botnet 19 months ago -- together with CrowdStrike, the Honeynet Project, and Dell SecureWorks -- as well as subsequent eradication efforts have lead to a sharp decline in related botnet activity.

"What we see now is what we expected," said Kaspersky Lab security researcher Stefan Ortloff in a blog post. "The botnet is getting smaller and smaller -- victims have been disinfecting or reinstalling their PCs over time. At the moment we're counting about 1,000 unique bots on average per month," down from about 116,000 just one year ago.

Ortloff said the vast majority of the botnet today is composed of malware-infected systems running Windows XP (86%), followed by Windows 7 (7%), and Windows Server 2008 R2 (4%). He added that the vast majority of infected clients (44%) are in Poland.

[ Protect your servers without breaking the bank. See Don't Be A Hacker's Puppet. ]

But the Kaspersky Lab report triggered a sharp retort from Hendrik "Rick" Adrian of white hat security research firm MalwareMustDie, who reported that as of Wednesday, he was seeing 1,231 Kelihos infections coming just from Poland, placing it well behind the Ukraine (52,825), Russia (18,158), Japan (9,823), and India (6,037), among other countries.

In total, Adrian -- who's also part of the ongoing "Op Kelihos" takedown effort -- said that as of Wednesday, he was seeing at least 100,848 active Kelihos infections.

Have reports of the botnet's demise been exaggerated? Asked that question, Kaspersky Lab's Global Research and Analysis Team said via email the blog post referenced only a single version of Kelihos. "The blog post is a status update on the sinkholing operation we did with our partners in March 2012. We don’t have any data or information which botnet in detail MalwareMustDie is referring to," they wrote. "There are and were several versions of Hlux/Kelihos, some were sinkholed, but others may still be active."

Dave Dittrich, a security researcher at the University of Washington -- and SANS instructor -- said via email that the decline of the Kelihos strain that Kaspersky Lab helped sinkhole looks legit. "Kaspersky is watching a set of bots that were abandoned, and living for a year and a half is just about what I would have expected, having watched another similarly abandoned botnet (named 'Nugache') in 2008 slowly die out over about a 1.5 year period."

But other versions of Kelihos continue to circulate, he said, in part thanks to "pay per install" (aka "malware as a service" providers) wielding malware such as Conficker, Fifesock, RedKit and Virut.

According to MalwareMustDie's Adrian, Kelihos eradication remains difficult because infected PCs can spread the infection to other PCs -- peers -- with which they connect, beyond the threat of users simply coming into contact with a Kelihos "loader" that would infect their system for the first time. "Each [of the] peers has more than 10+ payloads to spread [and a] smaller number of payloads exists in the loader part," he said.

Adrian added that Kelihos also continues to spread thanks to the botnet automatically creating new command-and-control (CnC) domains, as well as using fast flux techniques to hide the botnet's infrastructure behind multiple layers of proxies. From Aug. 6 until Nov. 12, the botnet had generated at least 800 new domains via Russian domain name registrar, including one that was registered Tuesday, he said.

"The above growth is still happening, even now we keep on suspending, sinkholing new domains [that are] used for spreading [the] payload -- which [is] encrypted in their job servers to [the] CnC layer to be sent to [peers] for infection [upgrades]," said Adrian. "The effort of current [suppression] is not related [to] the previous shutdown." Rather, he said, the current level of infections result from numerous security researchers coordinating their efforts to continue researching how the botnet operates and sinkholing all related domains.

Who's behind these Kelihos infections? That's not clear, but a significant portion of the attack infrastructure traces to Russia. Last week, a Pastebin post from MalwareMustDie detailed a relationship between domains being used to serve Kelihos payloads and the RedKit exploit kit. A series of RedKit infections have included a JavaScript injection script that points the infected PC to a site based in Russia that uses "the same infrastructure as the Kelihos botnet," according to MalwareMustDie.

Earlier this year, attackers -- who may not be part of the Kelihos gang -- loaded the RedKit crimeware pack onto hacked NBC websites, and launched drive-by attacks exploiting known Java and Adobe Reader vulnerabilities against all site visitors. The exploit pack then installed Citadel financial malware onto vulnerable PCs.

Advanced persistent threats are evolving in motivation, malice and sophistication. Are you ready to stop the madness? Also in the new, all-digital The Changing Face Of APTs issue of Dark Reading: Governments aren't the only victims of targeted "intelligence gathering." Enterprises need to be on guard, too. (Free registration required.)