At the end of October a ton of spam emails apparently pushing the would-be presidential candidate Ron Paul started dropping into peoples' inboxes in the US.
On his orders? One would have to think, judging by the negative reactions, that everybody in his campaign would know it's a bad idea.
Now, SecureWorks has trailed in depth where those spam emails came from, with a fascinating insight to the inner workings of a botnet.
Many of those machines being a bot were infected via
a well-known "iframe affiliate" malware install site, where the site owner gets paid by different botnet owners for spreading their malware. A trojan is installed by the exploit kit which regularly requests a remote configuration file containing URLs of additional malware to download and install.
The short story? It's a Russian-controlled botnet, running about 3,000 bots, with an email database 3.4 gigabytes in size containing 162,211,647 addresses (though many of those will be redundant or dead). The controller is written in Python.
But at the end of the fascinating investigation, who paid to send the spams?
With the facts above, we are left asking the question, "who paid to have the Ron Paul spam sent and how did they connect with the spammer, "nenastnyj?" The evidence shows that despite being capable of sending upwards of 200 million messages a day, nenastnyj is not one of the major spammers of the world, and seems to focus on spamming as an affiliate for larger "kingpin" operations. The Ron Paul spam was very much a "one-off" job among the other tasks in the Reactor interface. It almost seems as though there may have been some pre-established relationship between the sponsor of the spam and nenastnyj.
