Eideard

The Rustock botnet, which sent up to 30 billion spam messages per day, might have been run by two or three people. Early analysis, following raids to knock out the spam network, suggest that it was the work of a small team.

Rustock was made up of about one million hijacked PCs and employed a series of tricks to hide itself from scrutiny for years.

Since the raids on the network’s hardware, global spam levels have dropped and remain relatively low.

“It does not look like there were more than a couple of people running it to me,” said Alex Lanstein, a senior engineer at security firm FireEye, which helped with the investigation into Rustock…

He said that the character of the code inside the Rustock malware and the way the giant network was run suggested that it was operated by a small team…

Rustock evaded capture for years because of the clever way it was controlled, he said. Victims were snared when they visited websites seeded with booby-trapped adverts and links.

Once PCs were compromised, updates were regularly pushed out to them using custom written encryption. Those downloads contained the spam engine that despatched billions of ads for fake pharmaceuticals…

“When you are a programmer and you realise that you have the full force of the Microsoft legal department pointed directly at you, then you might say to yourself its time to try something else,” he said.

Any bets on whatever they do for grins, giggles and geedus, next – is legal? Once you get hooked on higher returns from crime it’s difficult to accept less.