back to article World's worst botnet fiends switch from ransomware to stock scam spam

Cybercriminals behind the Necurs botnet have reactivated the zombie network and returned to their original business of using compromised machines as conduits for spam distribution. In January, Cisco Talos reported that the Necurs botnet had gone offline, taking the typical volume of Locky ransomware-tainted spam emails with it …

  1. Anonymous Coward
    Anonymous Coward

    We are no longer the botnet called Ni!

    We are now the botnet called Necurs Necurs Patang Zoom Boing and Zowie Zing!!1!

    "ni."

    SHHHHH!!1!

    1. Halfmad

      Re: We are no longer the botnet called Ni!

      You should consider moving to SHHHHH!!2! ASAP AC!

  2. TeeCee Gold badge
    WTF?

    Necurs was abused to run a similar campaign...

    Abused? Surely that's what it's for?

  3. Anonymous Coward
    Facepalm

    Malspam runs on zombie network

    So, it's a spambot run on compromised Windows desktops. I thought such large scale spamming was eliminated or very much reduced what with most open email relays being disabled and the use of Sender ID and SPF. Indeed an Internet visionary once claimed that spam would be eradicated by year 2006

    1. Allan George Dyer
      Facepalm

      Re: Malspam runs on zombie network

      Yes, that visionary known for his previous prophetic utterings, "no-one will need more than 640K" and "HTTP protocols that define HTML Web browsing are extremely simple". With predictions like that, he'd never make it in business... oh wait!

    2. CrazyOldCatMan Silver badge

      Re: Malspam runs on zombie network

      use of Sender ID and SPF

      SPF? Since when do any large webmail[1] providers take notice of it? I regularly get spam bouncebacks on emails forged to use my home domain, depite having proper SPF in place.

      Sure some do take notice, but the vast majority of email providers don't[2].

      [1] Yes - Yahoo & BTInternet - I'm looking at you.

      [2] Which is why I block the China and Russia netblocks at my firewall. Dropped the spam attempts considerably. I'm considering adding Romania too. I'd love to deep-six the US nets too but I actually need to see US websites.

  4. Dr Scrum Master

    Botnets?

    Botnets or distributed cloud service providers?

  5. Winkypop Silver badge
    Coat

    Necurs

    We are ALL Necurs....

    Icon --> Getting 'Lucille' out

  6. Anonymous Coward
    Anonymous Coward

    So maybe that's why

    My home inbox received its first scam email in several years, and what a beauty it was, too! It was a rather better example of creative writing than most of my efforts, involving someone whose family has died in Syria, but they're unable to get out themselves and believe they will die there, and they will get their cook to post me a pair of golden clocks which cookie is unaware contain several credit cards each, and I am to withdraw certain amounts and give most to charity becuase the sender believes they will die soon, and they;re such a nice person they want their wealth to do some good, etc. (never mind how postie is to get the parcel out of the country in such dire circumstances).

    Honestly, despite its logical flaws and negative verity quotient, it really was quite a good piece of writing, and I cannot help wonder why the writer doesn't instead write for Mills & Boon instead, they'd make far more money , and with no danger of getting collared by the law (although I suppose a visit from The Stig requesting they get off his turf might be a bit of a dissuader...)

  7. Terry 6 Silver badge

    Assuming these botnets are made from Windows machines

    Why, with all the built-in firewalling and anti-virus and compulsory updates are there so many machines still open to compromise? Where are they? Why are they? Whose are they?

    1. Anonymous Coward
      Linux

      Re: Assuming these botnets are made from Windows machines

      "Why .. are there so many machines still open to compromise?"

      According to some security professionals, it isn't possible to have both security and productivity at the same time.

  8. Camilla Smythe

    Another Change to the Modus Operandi...

    New Text is,

    Alright, let's get right to it...

    We've been out of touch for a while. I've been very busy looking for the next big stock that has the potential to explode and it took me months to find one.

    If I can be honest, this one came to me as a god send. I got lucky. I have this friend who works at a law firm in NYC and we've known each other for a very long time.

    Long story short, he told me that his firm is about to finalize a big takeover by a multibillion corporation. They're buying this tiny company that is now trading at just around 10 cents a share.

    I couldn't believe my ears when I heard him say that they're paying somewhere between $1.30 and $1.39 for the company. The deal is closing and being announced mid next week.

    I could get into what the company does, but who really cares right? All we need to know is that they are in the high tech industry and that this is going to be a huge buyout.

    I recommend you buy shares as soon as possible today and wait it out until you get paid over $1.30 next week. The way takeovers work is that they will just credit this price per share, in cash, to your brokerage account and in exchange will take the shares that you bought at just pennies.

    I may never have another tip like this, so cash in on it while you still can.

    I have now received this message five times today... and from different people so obviously it is legit. I've spent at least another five hours screaming at my broker to buy and the fucking idiot says he needs to know which company.

    Like WTF?!1!?

    It's the company that is trading at "just around 10 cents a share" and is going to get bought out "somewhere between $1.30 and $1.39" DOH!

    1. Terry 6 Silver badge
      Coat

      Re: Another Change to the Modus Operandi...

      When you find out you will let us all know, won't you!

      (Coat icon - 'cos couldn't decide between joke or pint)

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like