BugTraq: Drone Armies C&C Report for Feb/2005
Just got this off of BugTraq. Interesting to see where the bots are located. If I find the pdf/website of the full report I'll add it here. :)
Quote:
Below is a periodic public report from the drone armies / botnets research and mitigation mailing list. For this report it should be noted that we base our analysis on the data we have accumulated from various sources.
According to our incomplete analysis of information we have thus far, we now publish two reports.
The ISP's that are most often plagued with botnet C&C's (command & control) are, by the order listed:
Code:
----------------------------------
Responsible Party Count ASN
SAGONE Sago Networks 16-20 21840
THEPL-1 THE PLANET* 16-20 {21844,13884}
PNAP Internap Network Services 11-15 {10913,13790,14742,14744}
STAMIN-2 Staminus Communicatio 11-15 25761
ATRIV Atrivo 11-15 27595
MSG-48 Managed Solutions Group 8-10 27645
YIPS Yipes Communications Inc 8-10 6517
LEVEL3 Level 3 Communications 8-10 3356
* Note that the above details are only for botnet C&C's that are still active.
* We would gladly like to establish a trusted relationship with these and any organizations to help them in the future.
* Please note the serious decrease in live Korean botnets, largely due to the efforts of KrCERT.
The Trojan horses most used in botnets:
---------------------------------------
The below details have not changed much, although we are seeing an increase in rBot variants.
1. Korgobot.
2. SpyBot.
3. Optix Pro.
4. rBot.
5. Other SpyBot variants and strains (AgoBot, PhatBot, actual SDbots, etc.).
