Its (Already) Baaack: Kelihos Botnet Rebounds With New Variant

Botnet hunters debate whether Kelihos/Hlux operators can reclaim rescued bots

Less than one day after botnet hunters announced they had crippled the Kelihos.B/Hlux.B botnet, a new version of the tenacious botnet is now back up and running today.
Researchers at Seculert were the first to point out the Kelihos/Hlux botnet was in action: Aviv Raff, co-founder and CTO at Seculert, late yesterday confirmed that his firm had seen the botnet spreading via a Facebook worm despite
the announcement yesterday by Kaspersky, CrowdStrike, Dell SecureWorks, and The Honeynet Project that they had knocked the botnet offline
. Raff says theres still communication under way via its command-and-control (C&C) servers.
We still see infected Kelihos.B machines, even new ones, sending spam and communicating with the C&C server, Seculerts Raff says.
But researchers from Kaspersky Lab, CrowdStrike, Fortinet, and Unveillance contend that this is a
new
variant of Kelihos/Hlux, not the same botnet that was taken down over the past few days. That one, KelihosB/HluxB -- which was built for spamming, information-stealing, DDoSing, as well as for pilfering Bitcoins and electronic wallets -- was sunk when the team poisoned it with their own code in order to redirect some 110,000 bots to their sinkhole server and away from the operators control. It was about three times as large as the first Hlux/Kelihos botnet, which was crippled last fall by a team led by Microsoft and that included Kaspersky.
Marco Preuss, head of global research and analysis in Germany for Kaspersky Lab, says the new botnet activity is coming from Hlux.C/Kelihos.C, and that the one that his firm and others took down remains offline. We confirm that a new Hlux/Kelihos sample exists, but it has a different configuration, which means its coming from a new Hlux botnet (Hlux C). The previous generation (Hlux B) is under control by the sinkhole server. It is not uncommon for new versions of botnets to appear that are operated by the same group, Preuss says.
CrowdStrikes Tillmann Werner says the Kelihos.B-infected machines in the sinkhole set up by CrowdStrike and the other research teams can no longer be used by the botnet operators, and has confirmed that the C&C infrastructure doesnt use the Kelihos.B protocol anymore. The researchers say they diverted some 110,000 infected machines to their sinkhole server.
The new Kelihos.C variant, which Werner says was released shortly after the sinkhole operation began, is completely separate and is spreading via social networks. It contains a tweaked message format for spreading commands to its peers, he says.
CrowdStrike isnt aware of any way for the new botnet to steal back its bots from the sinkhole, he says.
Bit Seculert maintains that this new botnet activity is still Kelihos.B: Some might call this a new variant or Kelihos.C. However, as the new infected machines are operated by the same group of criminals, which can also regain access to the sinkholed bots through the Facebook worm malware, we believe that it is better to still refer this botnet as Kelihos.B, according
to a blog post by the company that says more than 70,000 Facebook users were infected with the worm
.
Debates aside, Kelihos/Hluxs comeback was not unexpected by the botnet hunters. But it was certainly faster than most had predicted. Why the quick turnaround?
Kyle Yang, manager of AV engine development at Fortinet, says the botnet operators obviously were ready for a takedown this time around. According to Yangs findings, the botnet operators had in their possession two job servers from the first Kelihos/Hlux variant taken down by Microsoft. Job servers are controlled by C&C servers.
Pretty much those guys were ready for a takedown. They were just waiting for it, Yang says. The reason why [they did it] so quickly was they still had two [job] servers alive from the first botnet, he says. Those were not servers crippled by this weeks botnet takedown, however, he says.
Yang says he hasnt been able to figure out just how the malware authors regained control of those two servers from the first round. The attackers also since have put up three additional job servers in support of the C version of the botnet, he says.
Unveillance, meanwhile, was able to confirm that the new variant uses a different protocol. We can also confirm that the live sample weve been observing is what they are calling .C ... The two older binaries use well-formed HTTP and .C does not, says Karim Hijazi, CEO at Unveillance.
In reference to Seculerts claim that because the same botmasters may be operating this new version that it should be called .B instead of .C, we disagree. Due to the change in the communication protocol, it seems perfectly in keeping with standard AV naming convention to give this a new version name, he says. AV naming convention does not take into account distinct botnets within a given malware type. For example, the Mariposa C2 samples are still named Palevo/Rimecud, not Mariposa.
Most everyone does agree, however, that the only way to really kill a botnet is to apprehend its operators.
Next Page: Legal implications of taking over a P2P botnet?
Gunter Ollmann, vice president of research at Damballa, says botnet takedowns are a temporary disruption to the operation -- and when it comes to peer-to-peer networks like Kelihos, theres a legal conundrum.
Like Ive said before, if youre going to take down a botnet you have to take out the criminals at the top. Its the only way. Taking out the infrastructure they depend upon for distributing new infectious material and C&C is a disruption technique -- a delaying tactic if you will, and maybe an evidence building process if youre lucky,
Ollmann said in a blog post today
. In the case of P2P-based botnets, theres very little infrastructure you can get your hands on -- and youll probably end up having to issue commands to botnet victim devices -- which is fraught with legal and ethical problems.
[ Microsoft continued its aggressive legal tear against botnets with a new operation for which the software giant successfully seized some command-and-control (C&C) servers run by cybercriminals using Zeus and its related crimeware. See
Microsoft, Financial Partners Seize Servers Used In Zeus Botnets
. ]
And even if security vendors are able to successfully knock out a C&C infrastructure, its meaningless unless they also remove the infection vector, according to Ollmann. Even if youre lucky enough to be able to take out the C&C infrastructure or mechanism of communication, if you dont take out the infection vector -- the mechanisms of distributing new crimeware variants -- youve achieved very little. As evidenced by the most recent Kelihos botnet takedown attempt, the criminals retained their primary distribution system and are already accumulating thousands of new victims per day with their latest Kelihos-variant campaign, he wrote.
Kasperskys Preuss, meanwhile, maintains that even a temporary shutdown of a botnet is helpful in the fight against botnets. It would be naive to believe they would not continue to create new botnets for malicious use. Our sinkholing operations for Hlux A and B have shown that our countermeasure efforts are successful, even if its just a temporary way to slow the group down, he says.
But the big prize is the bad guys, he notes. The only way to permanently shut down botnets is to arrest and prosecute the creators and groups operating them. This is a difficult task because security companies encounter different federal policies, jurisdictions, and legal processes in various countries where botnets are located. This causes the law enforcement investigations and legal process to be a long and arduous process, Preuss says. The only way to accelerate this process is by having more international law passed that supports closer collaboration between cybersecurity professionals, law enforcement, and legal systems.
Meanwhile, Seculert reports that the majority of the infected Facebook users are from Poland and the U.S. -- a trend that was seen with the machines Kaspersky and CrowdStrike grabbed. Some 54 percent of the Facebook infections are in Poland, and 30 percent in the U.S., according to Seculert.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Its (Already) Baaack: Kelihos Botnet Rebounds With New Variant