Softpedia >News >Security
Softpedia Homepage   

Butterfly/Palevo Is the Most Prevalent Malware Family

Accounts for the highest number of infected hosts

Aug 3, 2010 14:38 GMT  ·  By
The Butterfly botnet client was the most prevalent malware during Q2 2010
   The Butterfly botnet client was the most prevalent malware during Q2 2010

According to a report from FireEye, the most prevalent malware family on the Internet at this moment is Palevo, the threat behind the infamous Mariposa botnet. According to data gathered by the security company during the past quarter, Palevo/Butterfly accounted for the biggest number of infected computers.

Palevo is a computer worm with backdoor capabilities, which is capable of spreading via removable storage devices, network shares, as well as instant messaging and file sharing applications. Criminals use this threat to steal sensitive information from infected computers, but also to build massive botnets that can be used to launch crippling distributed denial of service (DDoS) attacks.

Back in March, the Spanish authorities dismantled the gang behind the largest Palevo-based botnet, known as Mariposa (the butterfly), which at its peak counted as many as 12 million infected computers. In addition, last week the Slovenian Criminal Police arrested several people connected to the malware's development efforts, including a hacker who is believed to be the main author of the threat.

Despite these efforts, Palevo remains amongst the most stealthy and successful type of malware according to data from FireEye's MAX Cloud Intelligence network, which places it on 7.5% of all infected computers. The second most prevalent family of threats by number of unique infections is a trojan named Hiloti, which is used as a distribution platform for other malware. The third place is occupied by the financial fradusters' weapon of choice, the ZeuS (ZBot) information stealing trojan.

As far as the unique number of samples goes, Palevo is only in ninth place. But, according to the FireEye researchers this is actually a good thing for its authors. "This is good evidence that the cyber criminals behind this have been very successfully flying under the radar," they explain.

"The underground malware economy is no different from any other. It's the same world full of greed, rivalry, deceit and monopolies. Survival of the fittest also holds true here. Those who don't change with the times can't survive the opposition and perish eventually," the FireEye report concludes.

You can follow the editor on Twitter @lconstantin