Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Kelihos Botnet Thrives, Despite Takedowns

Fast flux infrastructure and Windows XP infections continue to keep the botnet alive.

Is the Kelihos botnet going bust?

Kaspersky Lab published research Tuesday that showed its sinkholing of one version of the Kelihos (a.k.a. Hlux) botnet 19 months ago with CrowdStrike, the Honeynet Project, and Dell SecureWorks -- as well as subsequent eradication efforts -- have led to a sharp decline in related botnet activity.

"What we see now is what we expected," Kaspersky Lab security researcher Stefan Ortloff wrote in a blog post. "The botnet is getting smaller and smaller -- victims have been disinfecting or reinstalling their PCs over time. At the moment we're counting about 1,000 unique bots on average per month," versus about 116,000 a year ago.

Ortloff said the vast majority of the botnet today is composed of malware-infected systems running Windows XP (86 percent), followed by Windows 7 (7 percent) and Windows Server 2008 R2 (4 percent). Forty-four percent of infected clients are in Poland.

[ Protect your servers without breaking the bank. See Don't Be A Hacker's Puppet. ]

But the Kaspersky Lab report triggered a sharp retort from Hendrik "Rick" Adrian of the white hat security research firm MalwareMustDie. He reported that, as of Wednesday, he was seeing 1,231 Kelihos infections coming just from Poland, placing it well behind the Ukraine (52,825), Russia (18,158), Japan (9,823), and India (6,037), among other countries. In total, Adrian -- part of the ongoing Op Kelihos takedown effort -- said he was seeing at least 100,848 active Kelihos infections as of Wednesday.

Have reports of the botnet's demise been exaggerated? Kaspersky Lab's Global Research and Analysis Team told us via email that the blog post referenced only a single version of Kelihos. "The blog post is a status update on the sinkholing operation we did with our partners in March 2012. We don't have any data or information which botnet in detail MalwareMustDie is referring to," the team wrote. "There are and were several versions of Hlux/Kelihos, some were sinkholed, but others may still be active."

Dave Dittrich, a SANS instructor and security researcher at the University of Washington, told us via email that the decline of the Kelihos strain that Kaspersky Lab helped sinkhole looks legit. "Kaspersky is watching a set of bots that were abandoned, and living for a year and a half is just about what I would have expected, having watched another similarly abandoned botnet (named 'Nugache') in 2008 slowly die out over about a 1.5 year period."

But other versions of Kelihos continue to circulate, he said, thanks in part to "pay per install" (a.k.a. malware-as-a-service) providers wielding malware such as Conficker, Fifesock, RedKit, and Virut.

According to Adrian, Kelihos eradication remains difficult because infected PCs can spread the infection to other PCs (peers) with which they connect, beyond the threat of users simply coming into contact with a Kelihos loader that would infect the system for the first time. "Each [of the] peers has more than 10+ payloads to spread, [and a] smaller number of payloads exists in the loader part."

Kelihos also continues to spread thanks to the botnet automatically creating command-and-control (CnC) domains, he said, as well as through fast flux techniques that hide the botnet's infrastructure behind multiple layers of proxies. From Aug. 6 through Nov. 12, the botnet had generated at least 800 domains via the Russian domain name registrar RegTime.net, including one that was registered Tuesday.

"The above growth is still happening, even now we keep on suspending, sinkholing new domains [that are] used for spreading [the] payload -- which [is] encrypted in their job servers to [the] CnC layer to be sent to [peers] for infection" upgrades, he said. "The effort of current [suppression] is not related [to] the previous shutdown." Rather, the current level of infections results from security researchers coordinating their efforts to continue researching how the botnet operates and sinkholing all related domains.

Who's behind these Kelihos infections? That's not clear, but a significant portion of the attack infrastructure traces to Russia. Last week, a Pastebin post from MalwareMustDie detailed a relationship between domains being used to serve Kelihos payloads and the RedKit exploit kit. A series of RedKit infections have included a JavaScript injection script that points the infected PC to a site based in Russia that uses "the same infrastructure as the Kelihos botnet," according to MalwareMustDie.

This year, attackers -- who might not be part of the Kelihos gang -- loaded the RedKit crimeware pack on to hacked NBC websites and launched driveby attacks exploiting known Java and Adobe Reader vulnerabilities against all site visitors. The exploit pack then installed Citadel financial malware on to vulnerable PCs.

Advanced persistent threats are evolving in motivation, malice, and sophistication. Are you ready to stop the madness? Also in the new, all-digital The Changing Face Of APTs issue of Dark Reading: Governments aren't the only victims of targeted intelligence gathering. Enterprises need to be on guard, too (free registration required).

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
11/17/2013 | 7:24:19 PM
no surprise
It's no surprise XP is the biggest target. There are many XP machines still out there and they will be major security holes for companies that continue to run them.
Mathew
50%
50%
Mathew,
User Rank: Apprentice
11/18/2013 | 5:43:29 AM
Re: no surprise
@Paul -- Well put. The quantity of infected XP machines that make up the Kelihos botnet suggest how many of these vulnerable machines are out there, ripe for exploitation, as well as how attackers will continue to tap them as a free and relatively easy to harvest resource.
aditshar
50%
50%
aditshar,
User Rank: Apprentice
11/18/2013 | 6:43:23 AM
Re: no surprise
I have been reading around for this Botnet, and could see that it's not too hard to spot, any one here who experianced malfunction due to this.
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
11/18/2013 | 7:33:15 PM
Re: no surprise
We have some computers that run laser welders and cutters and they need to run XP. I was going to put these on the network but thought better of it for this reason. It's not worth the risk.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25596
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. T...
CVE-2020-25597
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. Howeve...
CVE-2020-25598
PUBLISHED: 2020-09-23
An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar...
CVE-2020-25599
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory a...
CVE-2020-25600
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains...