Top Spam Botnet, “Grum,” Unplugged
Summary: The Grum spam botnet, which had been among the top three spam senders at up to 18 billion messages per day and roughly one-third of all spam, was disconnected from the Internet in July 2012 through an industry-led effort led by FireEye. FireEye's Atif Mushtaq said ISPs in Russia and Panama were harder to convince than Dutch ISP Ecatel, which pulled two control servers, and that Spamhaus saw average daily Grum sending IPs fall from about 120,000 to 21,505 after the takedown.
What you should know: Grum's takedown required disabling control servers across the Netherlands, Russia, Panama and Ukraine simultaneously, because missing even one would let the botmaster push an update and rebuild; the operators were never brought to justice, and the article ties Grum's pharmacy-spam profits to a hacker nicknamed "Gera" and a Russian named Nikolai Alekseevich Kostogryz.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026