Botnet grinds to a halt

We’ve been observing quite a small botnet – around 8000 zombie-machines – recently. Just a few days ago it exploded and started growing very quickly. The growth only stopped early yesterday evening – around 5pm Moscow time – when the overall total number of zombies was about 14000!

It’s interesting to take a look at how the network grew. We collected some stats which are shown in the graph below:

We have found that the botnet is mostly targeting machines in Russia. Maybe this explains why its growth slowed during what is night-time in the Russian Federation.

We detect the Trojan which is used to spread the infection as Trojan-Downloader.Win32.Small.ehe. Detection was added on 30th July 2007.

We’ll be keeping an close eye on this network and will keep you posted about new spikes of infections, so watch this blog.