For several years before July 2012 takedown, Grum was one of the notorious spam botnets and at one time was responsible for more than 30% of spam worldwide. Last year’s Grum botnet takedown was a victorious feat by the security community and could be considered as one of the most significant takedowns of 2012. However, the effect of this takedown seems to be temporary as we’ve observed spam volume from Grum bot trickling back:
The usual set of command which is basically a HTTP GET request at port 80 can be observed when it communicates to its C&C server.
GET /spm/s_get_host.php?ver=[bot version]
s_get_host.php - get the infected machine’s IP address and hostname
GET /spm/s_alive.php?id=[bot machineid]&tick=[system tick]&ver=[bot version]&smtp=[ok|bad]
s_alive.php - reports back to the control server that the bot is alive. The data includes bot id, system tick,bot version and smtp status to control server
GET /spm/s_task.php?id=[bot machine id]&tid=xxxxx
s_task.php - get task and spam templates.
GET /spm/s_report.php?task=[task id]&id=[bot machine id]&errors[xxx]=xx
s_report.php - reports back errors to the command and control server.
The spamming began right after it received the encrypted spam template:
The spam campaigns from Grum were the usual suspect: pharmaceutical spam. The link in the spam points to an illegal pharmacy website operation. I’ve also listed the Russian domains related to this spam campaign, here.
The spam volume from Grum that we are seeing today is a pale shadow of what it was before the July 2012 takedown. But it is worth noting that Grum is showing a slow come back. Perhaps bot herders behind Grum botnet are slowly rebuilding it again. We’ve been involved in helping various botnet takedowns before, but most of the time, the effect is temporary. It seems this botnet is deeply rooted, that you couldn't take it down by its branch and fruit, but by its roots.
Trustwave Secure Email Gateway customers are protected against this spam campaign.