Spam botnets: The fall of Grum and the rise of Festi

Revision as of 20:31, 5 August 2015 by Eric.freyssinet (talk | contribs) (Text replacement - " août " to " aug")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

(Publication) Google search: [1]

Spam botnets: The fall of Grum and the rise of Festi
Botnet Festi, Grum, Cutwail
Botnet/malware group
Exploit kits
Distribution vector
Operation/Working group
Date 2012 / 16 aug2012
Editor/Conference Spamhaus
Link (Archive copy)
Author Thomas Morrison


In July 2012, FireEye in cooperation with other security organisations, such as Spamhaus, took down the Grum botnet. At that time Grum was the third largest spam-sending botnet. The event gained considerable media attention.

Spamhaus worked on the takedown of the botnet by contacting the responsible ISPs that were hosting the botnet controllers. These controllers (also known as command & control servers) were being used by the botnet herder to control the botnet and coordinate the spam campaigns. After the command and control infrastructure of the Grum botnet had been shut down, the cybercriminals tried to re-establish their spam operation by setting up new botnet controllers. Fortunately, FireEye informed Spamhaus without any delay so that we could help shut down the new controllers quickly as well.

Since the takedowns Spamhaus has continued to monitor the Grum botnet, which at present consists of only 150 to 500 active (spam sending) IP addresses per day. Hence, one month later we can consider the Grum botnet dead.


 @misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2012BFR1097,
   editor = {Spamhaus},
   author = {Thomas Morrison},
   title = {Spam botnets: The fall of Grum and the rise of Festi},
   date = {16},
   month = Aug,
   year = {2012},
   howpublished = {\url{}},