Botnet management app exposed

A new and unusually sophisticated application for controlling and monitoring botnet PCs has been discovered by security company Panda Software.

Called Zunker, it turns out to be a PC management application like no other. The company reports that the program is capable of giving botnet criminals user-friendly graphs of individual botnet performance, including the number of available compromised "zombies" on each at any one time, and their levels of activity on a daily or monthly basis.

To all intents and purposes, Zunker operates as would any other PC management system except that the intent of the application is criminal.

According to Panda Software, Zunker has been used to control and monitor tens of thousands of PCs across up to 54 countries, which would put it in control of a fairly standard botnet. Fifty-four percent of the PCs infected remained under its control at the time of its discovery.

"The program has been carefully designed and is easy to use. Zunker organizes the bots by country, and shows how many bots there are along with reports from each one, how much spam has been sent and what software has been used by the bots to send the spam (Gmail, IM, forums, etc)," said Panda Software's Luis Corrons.

Zunker could give botnetters statistics on the lifespan of particular botnets -- how many infected PCs were still in operation -- and allow files to be downloaded to infected PCs to perform activities beyond basic spam relaying, such as information theft.

According to Corrons, the innovation of Zunker was that it offered both control and monitoring in one interface, something that has not been seen before to this degree. The Zunker botnet was recently responsible for a sizable volume of spam designed to spread the Alanchum.VL Trojan.

"This is a lucrative crime. The bot-herder can rent out the network to the highest bidder. Cybercrooks use them for a wide range of criminal activities including downloading malware onto infected computers, distributing spam or phishing messages or causing denial of services. The bot-herder can also use the botnet for their own activities, although this is less common," said Corrons.