SOURCE: Marshal

May 12, 2008 15:02 ET

Marshal Says Srizbi Botnet Accounts for Half of All Spam

Sending More Than 60 Billion Messages per Day, World's Largest Spam Botnet Now Produces More Spam Than All Other Botnets Combined

ATLANTA, GA--(Marketwire - May 12, 2008) - A single botnet has grown so dramatically in the last two months that it now accounts for half of all the spam, according to new research from Marshal's TRACE team. The Srizbi botnet has steadily increased its network since the beginning of 2008 and is now the world's largest spam botnet.

"Srizbi is the single greatest spam threat we have ever seen," said Bradley Anstis, vice president of Products at Marshal. "At its peak, the highly publicized Storm botnet only accounted for 20 percent of spam. Srizbi now produces more spam than all the other botnets combined."

Srizbi is estimated to comprise at least 300,000 compromised computers and sends more than 60 billion spam messages per day. Recently, the botnet has been used to promote a range of products including watches, pens and male enlargement pills. Srizbi also actively distributes copies of its own malware in malicious spam campaigns using social engineering ploys to trick recipients into infecting their computers.

"Microsoft recently announced its success combating the Storm botnet with their Malicious Software Removal Tool (MSRT)," said Anstis. "The challenge now is for the security industry to turn its sights on Srizbi and the other major botnets. We look forward to seeing Microsoft target Srizbi with MSRT in the near future."

In January, Marshal announced findings that the infamous Storm botnet had lost its place as the number one source of spam to the Mega-D botnet; otherwise known as Ozdok. Marshal's latest data shows that Srizbi's rise to prominence in February coincided with the decline of the Mega-D botnet after its control servers were taken offline for 10 days.

"It is difficult to say for certain why Mega-D went offline after we announced our findings," said Anstis. "It is probable the spammers got spooked and decided to lay low for a while. Security researchers were close to discovering their control servers when the plug was pulled. Typically, the spammers like the 'low and slow' approach, building their botnet up over time and trying to stay under the radar to avoid detection. It is an intriguing chain of events that as Mega-D went offline; Srizbi stepped in to fill the gap and hasn't looked back since."

Mega-D quickly bounced back and regularly jostles with the Rustock botnet for second place in Marshal's spam statistics. Marshal's TRACE researchers have observed individual computers infected with the Rustock malware sending as many as 25,000 spam messages an hour.

"While other botnets such as Rustock might be smaller in terms of the number of compromised computers under their control they can be very efficient at sending spam," added Anstis.

Marshal's charts and statistics depicting botnet activity over time can be found on the TRACE Center:

About the Marshal TRACE Team

TRACE (Threat Research and Content Engineering) is a group of Marshal security analysts who constantly monitor and respond to Internet security threats through the TRACE website at TRACE services are provided as part of standard product maintenance that includes updates to Marshal's unique, proprietary anti-spam technology, SpamCensor. TRACE analyzes spam, phishing and Internet security trends and provides frequent automated updates to Marshal customers. It also provides "Zero Day" security protection against new email and virus exploits the day they emerge.

About Marshal

Marshal is a global leader in content security across multiple protocols, enabling organizations to secure their IT environment, protect against threats and comply with corporate governance needs. Marshal provides customers with a complete portfolio of policy-driven email and Internet solutions that integrate content filtering, compliance, secure messaging and archiving. Forty percent of the Global Fortune 500 companies use Marshal security solutions to secure their corporate messaging networks and Web access against internal abuse and external threats such as viruses, spam and malicious code. More than 7 million users in over 18,000 companies worldwide use Marshal solutions to protect their networks, employees, business assets and corporate reputation and to comply with corporate governance legislation requirements.

Marshal's Americas headquarters is in Atlanta, Georgia, with corporate headquarters in London (UK) and offices in Auckland (New Zealand), Houston (USA), Johannesburg (South Africa), Munich (Germany), Paris (France) and Sydney (Australia). More information is available at

Contact Information