Botnet Behavior Continues To Change

The "Sdbot" and "Gaobot" botnets families account for 80% of the world's bots. They are followed by Oscarbot, IRCbot and RXbot, but in much smaller numbers.

The good news, as we've been telling you, the bots aren't relying on IRC anymore for command and control.

The bad news is the bots are utilizing rootkits and other means to hide silently on the infected systems for longer periods of time without anyone discovering them. Worse as reported by DISOG, botnet operators are also splitting up their networks into smaller teams so they don't attract as much attention from law enforcement.

Since the botnets don't appear as large, law enforcement are unwilling to focus their attention on them, improperly thinking that they don't pose any threat. But once the power of the smaller teams are combined they become just as powerful as the old large botnets.