Loading story…
Researchers identified Trojan.Srizbi as a highly sophisticated Windows kernel-mode spam bot and rootkit that spread through drive-by web attacks using injected malicious IFRAMEs on legitimate sites, which redirected victims to exploit kits including MPack and n404. Once installed, Srizbi loaded a kernel driver, hid files and registry entries, bypassed security hooks, and used a private TCP/IP stack with low-level NDIS hooks to communicate directly with HTTP-based command-and-control servers from ring 0, helping it evade personal firewalls and maintain resilient spam operations.
Further investigation tied Srizbi to large-scale spam activity, including the late-October "Ron Paul" email campaign, which analysts concluded was sent by an existing botnet rather than a purpose-built political network. Distinctive email header fingerprints, thousands of sending IPs, and seized controller software linked the operation to the Reactor Mailer spam platform run by a spammer known as spm, with the campaign attributed to an account named nenastnyj; researchers also found that Srizbi could remove competing rootkits such as Rustock.B and Pandex, and published detection guidance including Snort signatures for its network traffic.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
A spam campaign promoting Ron Paul ran from October 27 to October 30, 2007. Researchers later concluded it was sent through an existing Srizbi botnet that also distributed ordinary spam such as pharmaceuticals and fake watches.
In June 2007, attackers injected malicious IFRAMEs into legitimate Italian and Russian websites, redirecting visitors to an MPack exploit kit. That infrastructure downloaded several trojans, including Srizbi, from 81.95.146.150.
Analysts began examining Srizbi's kernel-mode driver in June 2007 as the malware emerged in the wild. Their work found no signs of user-mode injection, indicating the malware operated entirely in ring 0.
Researchers identified Srizbi variants compiled as early as March 31, 2007, and later traced older Srizbi samples back to April 2007, indicating the malware was in circulation by spring 2007.
Arbor Networks researchers reported that StormWorm bots were launching distributed denial-of-service attacks against Srizbi domains, showing conflict between major botnet operators.
Investigators identified 16 additional nearby servers controlling different Srizbi variants, indicating the botnet was segmented and likely rented to multiple customers for separate spam campaigns.
Analysis of recently compromised machines showed that Srizbi was being distributed through the n404 web exploit kit via the malicious site msiesettings.com. The installer also fetched a remote configuration file with URLs for additional malware downloads.
Examination of the seized controller software showed that Srizbi served as the mailing component of Reactor Mailer, a spamware platform operated by the spammer 'spm.' The investigation also found a customer account named 'nenastnyj' and a saved task 'RonP_3' linked to the Ron Paul spam run.
With assistance from Spamhaus, researchers shut down a Srizbi command-and-control server and obtained its running Python controller software for analysis. This enabled deeper investigation into the botnet's operation.
After tracking several thousand sending IPs and analyzing distinctive email header fingerprints, researchers identified Trojan.Srizbi as the malware behind the Ron Paul spam botnet and traced its command-and-control server to a U.S. co-location facility.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rustock operated as a stealthy Windows rootkit and modular spam bot that injected its spam component into `services.exe`, used encrypted HTTP `POST` traffic for command-and-control, and protected those exchanges with **RC4** after a key-exchange phase. Reverse-engineering showed the malware could profile infected hosts, kill competing malware, download spam templates and recipient lists, retrieve mail-server targets and SMTP failure strings, and update itself while remaining difficult to detect. Public sample collections and analysis links document multiple variants including **Rustock.C**, **Rustock.E**, **Rustock.I**, **Rustock.J**, and related builds observed across several years. Investigators later tied parts of Rustock’s infrastructure to financially motivated spam operations, including counterfeit-drug promotions linked to the **SpamIt** and **Rx-Promotion** affiliate programs and pump-and-dump stock campaigns. After Microsoft seized dozens of U.S.-hosted command-and-control servers, reporting traced hosting payments to a **WebMoney** account associated with a person identified as *Vladimir Shergin* in Saint Petersburg, though definitive attribution remained unresolved. Separate monitoring of the botnet’s spam runs showed how operators could profit by promoting thinly traded penny stocks, with one observed campaign driving heavy trading and a sharp price increase after millions of spam emails were sent.
Aug 15, 2026
The **Sasfis** malware campaign used phishing emails posing as shipping invoices, delivery notices, and in some cases targeted tax-related messages to trick recipients into downloading malicious executables. Researchers described Sasfis as a command-driven bot client that contacted command-and-control infrastructure over HTTP-like and encrypted channels, then installed follow-on malware including **Zeus** banking trojans, keyloggers, password stealers such as **Grabberz**, **FakeAV**, and the **Asprox/Dammec** malware family. Early reporting also noted very low antivirus detection and anti-analysis behavior, including apparent blocking of traffic from known public sandbox IP addresses. Later analysis found the botnet evolved quickly, improving resilience through **custom packers**, encrypted registry storage, **RC4-encrypted** command-and-control IP lists, and rotating dynamic IP pools. Sasfis was distributed through the **Asprox** spambot and increasingly shifted from attachment-based lures to image-based spam linking to hosted malware, while newer variants shared infrastructure with Asprox itself. Investigators also reported technical overlaps with the earlier **Dofoil** campaign, including similar code injection methods, the export name `work`, and server reuse shortly after Dofoil activity ended, suggesting a close operational link between the malware operations.
Aug 15, 2026
Zloader, a **ZeuS-derived banking trojan** that steals browser data, cookies, passwords, screenshots, and other host information, was used in multiple campaigns that combined layered delivery chains with strong evasion and persistence. Researchers documented malspam operations using **MHTML attachments**, password-protected XLS files, VBA and XLM macros, and `rundll32.exe`, as well as a later campaign that used the legitimate RMM tool **Atera** for initial access. In that operation, attackers weakened Microsoft Defender, disabled investigation tools, and abused a weakness in **Microsoft Authenticode** by appending malicious script content to Microsoft-signed DLLs while preserving a seemingly valid signature, then launching the script with `mshta.exe` and executing Zloader through `regsvr32.exe`. Across samples, Zloader commonly injected its core payload into a suspended `msiexec.exe` process, stored encrypted configuration data, and maintained persistence through Startup-folder scripts and Windows Run keys. Technical analyses showed Zloader evolving into a **modular malware platform** with anti-analysis features including encrypted strings, runtime API resolution, filename checks, process injection, and heavy **API hammering** that can generate more than a million file or registry-related calls before payload execution. Newer variants retained RC4-encrypted configuration data but added revised domain-generation logic and network protections using **RSA**, **RC4**, and Zeus BinStorage-style encryption over HTTP POST. Microsoft, ESET, Lumen Black Lotus Labs, Palo Alto Networks Unit 42, and others later disrupted three Zloader botnets by seizing **65 active command-and-control domains** and **319 DGA-generated domains**, while reporting that the malware had been tracked since 2019 across roughly **14,000 unique samples** and more than **1,300 C2 servers**, with some affiliates tied to **DarkSide ransomware**, **Cobalt Strike**, **Raccoon infostealer**, and large victim populations in North America.
Aug 15, 2026