Asprox

Asprox is a botnet and spam-focused malware operation first identified around 2008, also known as Badsrc and Aseljo. It is best known for large-scale spam activity, phishing-related campaigns, and the compromise of vulnerable websites through automated SQL injection, particularly against Microsoft Active Server Pages applications. Infected systems were used to scan for susceptible sites, inject malicious iframe or script-based redirects, and drive visitors to exploit or malware delivery infrastructure, giving the operation worm-like propagation characteristics through botnet-assisted website compromise rather than a self-contained worm mechanism.

Operationally, Asprox combined commodity botnet functions with web-application exploitation. Compromised hosts searched for vulnerable websites, attempted SQL injection, and modified pages so that visitors were redirected to malicious content that installed additional malware. Reported payloads associated with Asprox-driven campaigns included Asprox itself, Cutwail, rogue security software, and in later ecosystems malware distributed through Sasfis. Asprox was also used as the sole spreading mechanism for the 2012 Sasfis campaign, where spam lures themed as delivery notices and later image-based emails linked victims to malicious executables. The broader Asprox ecosystem has also been associated with theft of personal and financial information and monitoring of user online activity.

The botnet operated in waves, infecting large numbers of websites and then going dormant for periods, apparently to reduce defensive pressure. Documented waves occurred in 2008, 2009, and 2010, with rapid growth in the number of compromised domains during some surges. Reported targets included government, healthcare, business, and major consumer-facing websites. Asprox has been characterized as a notable non-targeted malware threat globally and as a long-running criminal botnet centered on spam distribution, phishing enablement, and SQL-injection-based malware propagation.