March 12, 2010--The shut down and recovery of the Troyak-as command and control center (C&C) for the active Zeus botnet was good news for the whole IT security community. But unfortunately, as some botnets struggle, others stay unaffected. As part of their relentless effort to stay ahead of cybercriminals, Kaspersky Lab's research and analysis team have recently monitored a surge in Koobface C&C servers, the highly prolific worm infesting social networking sites. Koobface targets sites such as Facebook and Twitter, and uses compromised legitimate websites as proxies for its main command and control (C&C) server.
Definition of Command & Control Center
Command and control centers are servers maintained by the owners of a botnet and used to enable the infected computers to "call back to their masters" and get updates and commands, such as downloading new or more malware, or stealing various computer files or personal information, such as banking accounts.
During the past 2 weeks, the Kaspersky research team has observed the Koobface live C&C servers shut down or cleaned on an average of three times per day. The number dropped steadily from107 on February 25 to as low as 71 on March 8. Then, in just 48 hours, the number grew from 71 to 142, precisely doubling the total number of C&C servers, which all Koobface infected computers use to get remote commands and updates (see chart).
| 1. United States | 52.23% |
| 2. Germany | 8.48% |
| 3. Canada | 4.46% |
| 4. Great Britain | 3.57% |
| 5. Netherlands | 3.13% |
| 6. Denmark | 2.68% |
| 7. Turkey | 2.68% |
| 8. Belgium | 2.68% |
| 9. Austria | 2.23% |
| 10. Switzerland | 1.79% |
Command & Control Centers Hosted in U.S. Increase
Another interesting element currently happening with the Koobface command and control infrastructure can be observed when looking at the evolution of the geographical location of IP addresses used to communicate with the infected computers. The usage of C&C servers hosted in the United States is increasing, growing from 48 percent to 52 percent. Currently, more than half of the Koobface C&C servers are hosted in the United States, far exceeding any other country.