Necurs Diversifies Its Portfolio
Summary: Cisco Talos observed a marked increase in spam from the Necurs botnet on March 20, 2017, with tens of thousands of messages sent over a single morning that carried no malicious links or attachments and instead promoted a penny stock, InCapta Inc ($INCT), as a buyout target at $1.37 per share. Talos said the botnet, previously a primary distributor of Locky ransomware and the Dridex banking trojan, had gone quiet in late December 2016, when email volume dropped to less than half its typical flow, and its block list entries spiked from an average of 50K addresses to over 150K during the new campaigns.
Key Takeaway: The same botnet that delivered Locky and Dridex at millions of messages per day can be repointed at a pump-and-dump scheme in hours, and trading volume in the touted stock jumped from over 1 million shares to over 4.5 million in a day - a reminder that a dormant botnet is not a retired one.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026