Did Grum Really Get Killed?

For several years before July 2012 takedown, Grum was one of the notorious spam botnets and at one time was responsible for more than 30% of spam worldwide. Last year's Grum botnet takedown was a victorious feat by the security community and could be considered as one of the most significant takedowns of2012. However, the effect of this takedown seems to be temporary as we've observed spam volume from Grum bot trickling back:

Over the last little while, we run a number of Grum samples and observed new command & control (C&C) servers that the bot connects to:

• 188.93.233.2
• 185.4.227.170
• 198.144.156.187
• 80.86.253.3
• 84.22.104.163

The usual set of command which is basically a HTTP GET request at port 80 can be observed when it communicates to its C&C server.

• GET /spm/s_get_host.php?ver=[bot version]

  s_get_host.php - get the infected machine's IP address and hostname

• GET /spm/s_alive.php?id=[botmachineid]&tick=[system tick]&ver=[bot version]&smtp=[ok|bad]

s_alive.php - reports back to the control server that the bot is alive. The data includes bot id, systemtick, bot version and smtp status to control server

• GET /spm/s_task.php?id=[bot machineid]&tid=xxxxx

s_task.php - get task and spam templates.

• GET /spm/s_report.php?task=[task id]&id=[botmachine id]&errors[xxx]=xx

s_report.php - reports back errors to the command and control server.

The spamming began right after it received the encrypted spam template:

The spam campaigns from Grum were the usual suspect: pharmaceutical spam. The link in the spam points to an illegal pharmacy website operation. I've also listed the Russian domains related to this spam campaign, here.

The spam volume from Grum that we are seeing today is a pale shadow of what it was before the July 2012takedown. But it is worth noting that Grum is showing a slow come back. Perhaps bot herders behind Grum botnet are slowly rebuilding it again. We've been involved in helping various botnet takedowns before, but most of the time, the effect is temporary. It seems this botnet is deeply rooted, that you couldn't take it down by its branch and fruit, but by its roots.