Netsky and Mytob in turf war battle

By Steve Malone

Posted on 2 Sep 2005 at 10:47

Different groups of hackers are competing with each other to create the greatest number of infections. According to security firm Kaspersky, cyber wars affected the August figures with teams behind Netsky.q and Mytob.c (also known as Zotob). Some cyber wars are caused by competing teams not only spreading their own malware, but are actually removing competing worms from target machines.

Kaspersky says it has seen groups of virus writers trying to remove malware written by other groups from infected machines: each group is striving to be the sole owner of any given zombie. These groups will even go so far as to hack each other's sites or hackers from one country try to break into government servers in another country.

Although this might sound like a simple competition between amateur hackers, it also represents a turf war between gangs who use the malware to build up armies of zombies for denial of service attacks, spamming, phishing and other criminal activities.

In the Kaspersky listings variants of Netsky took three of the top ten positions while Mytob variants took four. Mytob.c accounted for 16.28 per cent of the infections with Netsky.q taking 11.38 per cent.

The picture is confused somewhat by some security firms announcing a new threat when, in fact it is a variation of an older one.

'Mytob and Zotob may spread in different ways, but the source code is very similar,' commented Carole Theriault, security consultant at Sophos. 'Moreover, the Zotob author's nickname, Diabl0, appears in more than twenty of the Mytob variants, suggesting that they may have been created by the same person. One thing is for sure - Mytob is still causing chaos in organisations that haven't updated their virus protection and patched software vulnerabilities.'

It remains to be seen whether the recent arrests concerning Zotob will see fewer version of the worm appearing or, as with Netsky, variants will still occur even though the author has been found and convicted.