The Many Tentacles of the Necurs Botnet
Summary: Cisco Talos extracted 32 Necurs spam campaigns sent between August and November 2017, yielding over 2.1 million messages from almost 1.2 million distinct sending IP addresses across more than 200 countries and territories. Of those sending IPs, 937,761 (78.6%) appeared in only a single campaign, and none appeared across all 32.
What's compelling: Necurs can run months of attacks without reusing most of its sending nodes, so blocklisting individual IPs removes only a sliver of an infrastructure that size. The recipient lists also carry addresses harvested years earlier, including one stolen from Equifax before its 2017 breach.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026