Jump to content

Kelihos botnet: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
No edit summary
Rescuing 3 sources and tagging 0 as dead. #IABot (v1.3beta8)
Line 3: Line 3:


== History ==
== History ==
The Kelihos botnet was first discovered around {{Nowrap|December 2010}}.<ref name="Ortloff">{{cite web|url=http://www.securelist.com/en/blog/208193438/FAQ_Disabling_the_new_Hlux_Kelihos_Botnet|title=FAQ: Disabling the new Hlux/Kelihos Botnet|last=Ortloff|first=Stefan|date=28 March 2012|work=[[Securelist.com]]|accessdate=28 April 2012}}</ref> Researchers originally suspected having found a new version of either the [[Storm botnet|Storm]] or [[Waledac]] botnet, due to similarities in the [[modus operandi]] and [[source code]] of the bot,<ref name="Adair">{{cite web|url=http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20101230|title=New Fast Flux Botnet for the Holidays: Could it be Storm Worm 3.0/Waledac 2.0?|last=Adair|first=Steven|date=30 December 2010|work=Shadowserver|accessdate=28 April 2012}}</ref><ref name="Donohue">{{cite web|url=http://threatpost.com/en_us/blogs/kelihos-returns-same-botnet-or-new-version-032912|title=Kelihos Returns: Same Botnet or New Version?|last=Donohue|first=Brian|date=29 March 2012|work=Threatpost|accessdate=28 April 2012}}</ref> but analysis of the botnet showed it was instead a new, 45,000-[[Trojan horse (computing)|infected]]-computer-strong, botnet that was capable of sending an estimated {{Nowrap|4 billion}} spam messages a day.<ref name="Mills2">{{cite web|url=http://news.cnet.com/8301-1009_3-20112289-83/microsoft-halts-another-botnet-kelihos/|title=Microsoft halts another botnet: Kelihos|last=Mills|first=Elinor|date=27 September 2011|work=[[CNet]]|accessdate=28 April 2012}}</ref><ref name="Kirk">{{cite web|url=http://www.networkworld.com/news/2012/020112-kelihos-botnet-once-crippled-now-255571.html|title=Kelihos botnet, once crippled, now gaining strength|last=Kirk|first=Jeremy|date=1 February 2012|work=[[Network World]]|accessdate=28 April 2012}}</ref> In {{Nowrap|September 2011}}<ref name="Constantin">{{cite web|url=http://www.pcworld.com/businesscenter/article/252763/security_firms_disable_the_second_kelihos_botnet.html|title=Security Firms Disable the Second Kelihos Botnet|last=Constantin|first=Lucian|date=28 March 2012|work=[[PCWorld (magazine)|PCWorld]]|accessdate=28 April 2012}}</ref> [[Microsoft]] took down the botnet in an operation codenamed "Operation b79".<ref name="Mills2"/><ref name="Boscovich">{{cite web|url=http://blogs.technet.com/b/microsoft_blog/archive/2011/09/27/microsoft-neutralizes-kelihos-botnet-names-defendant-in-case.aspx|title=Microsoft Neutralizes Kelihos Botnet, Names Defendant in Case|last=Boscovich|first=Richard|date=27 September 2011|work=[[Microsoft TechNet]]|accessdate=28 April 2012}}</ref> At the same time, Microsoft filed civil charges against Dominique Alexander Piatti, dotFREE Group SRO and 22 [[John Doe]] defendants for suspected involvement in the botnet for issuing 3,700 [[subdomains]] that were used by the botnet.<ref name=Boscovich/><ref name="Microsoft">{{cite web|url=http://blogs.technet.com/b/mmpc/archive/2011/09/26/operation-b79-kelihos-and-additional-msrt-september-release.aspx|title=Operation b79 (Kelihos) and Additional MSRT September Release|last=Microsoft|date=26 September 2011|work=[[Microsoft Technet]]|accessdate=28 April 2012}}</ref> These charges were later dropped when Microsoft determined that the named defendants did not intentionally aid the botnet controllers.<ref name="Latif">{{cite web|url=http://www.theinquirer.net/inquirer/news/2120576/microsoft-drops-kelihos-botnet-allegations-isp-owner|title=Microsoft drops Kelihos botnet allegations against ISP owner|last=Latif|first=Lawrence|date=27 October 2011|work=[[The Inquirer]]|accessdate=28 April 2012}}</ref><ref name="Gonsalves">{{cite web|url=http://www.crn.com/news/security/232500413/microsoft-says-ex-antivirus-maker-ran-botnet.htm|title=Microsoft Says Ex-Antivirus Maker Ran Botnet|last=Gonsalves|first=Antone|date=24 January 2012|work=[[CRN Magazine]]|accessdate=28 April 2012}}</ref>
The Kelihos botnet was first discovered around {{Nowrap|December 2010}}.<ref name="Ortloff">{{cite web|url=http://www.securelist.com/en/blog/208193438/FAQ_Disabling_the_new_Hlux_Kelihos_Botnet|title=FAQ: Disabling the new Hlux/Kelihos Botnet|last=Ortloff|first=Stefan|date=28 March 2012|work=[[Securelist.com]]|accessdate=28 April 2012}}</ref> Researchers originally suspected having found a new version of either the [[Storm botnet|Storm]] or [[Waledac]] botnet, due to similarities in the [[modus operandi]] and [[source code]] of the bot,<ref name="Adair">{{cite web|url=http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20101230|title=New Fast Flux Botnet for the Holidays: Could it be Storm Worm 3.0/Waledac 2.0?|last=Adair|first=Steven|date=30 December 2010|work=Shadowserver|accessdate=28 April 2012}}</ref><ref name="Donohue">{{cite web|url=http://threatpost.com/en_us/blogs/kelihos-returns-same-botnet-or-new-version-032912 |title=Kelihos Returns: Same Botnet or New Version? |last=Donohue |first=Brian |date=29 March 2012 |work=Threatpost |accessdate=28 April 2012 |deadurl=yes |archiveurl=https://web.archive.org/web/20120404160139/http://threatpost.com/en_us/blogs/kelihos-returns-same-botnet-or-new-version-032912 |archivedate= 4 April 2012 |df= }}</ref> but analysis of the botnet showed it was instead a new, 45,000-[[Trojan horse (computing)|infected]]-computer-strong, botnet that was capable of sending an estimated {{Nowrap|4 billion}} spam messages a day.<ref name="Mills2">{{cite web|url=http://news.cnet.com/8301-1009_3-20112289-83/microsoft-halts-another-botnet-kelihos/|title=Microsoft halts another botnet: Kelihos|last=Mills|first=Elinor|date=27 September 2011|work=[[CNet]]|accessdate=28 April 2012}}</ref><ref name="Kirk">{{cite web|url=http://www.networkworld.com/news/2012/020112-kelihos-botnet-once-crippled-now-255571.html |title=Kelihos botnet, once crippled, now gaining strength |last=Kirk |first=Jeremy |date=1 February 2012 |work=[[Network World]] |accessdate=28 April 2012 |deadurl=yes |archiveurl=https://web.archive.org/web/20120905061925/http://www.networkworld.com/news/2012/020112-kelihos-botnet-once-crippled-now-255571.html |archivedate= 5 September 2012 |df= }}</ref> In {{Nowrap|September 2011}}<ref name="Constantin">{{cite web|url=http://www.pcworld.com/businesscenter/article/252763/security_firms_disable_the_second_kelihos_botnet.html|title=Security Firms Disable the Second Kelihos Botnet|last=Constantin|first=Lucian|date=28 March 2012|work=[[PCWorld (magazine)|PCWorld]]|accessdate=28 April 2012}}</ref> [[Microsoft]] took down the botnet in an operation codenamed "Operation b79".<ref name="Mills2"/><ref name="Boscovich">{{cite web|url=http://blogs.technet.com/b/microsoft_blog/archive/2011/09/27/microsoft-neutralizes-kelihos-botnet-names-defendant-in-case.aspx|title=Microsoft Neutralizes Kelihos Botnet, Names Defendant in Case|last=Boscovich|first=Richard|date=27 September 2011|work=[[Microsoft TechNet]]|accessdate=28 April 2012}}</ref> At the same time, Microsoft filed civil charges against Dominique Alexander Piatti, dotFREE Group SRO and 22 [[John Doe]] defendants for suspected involvement in the botnet for issuing 3,700 [[subdomains]] that were used by the botnet.<ref name=Boscovich/><ref name="Microsoft">{{cite web|url=http://blogs.technet.com/b/mmpc/archive/2011/09/26/operation-b79-kelihos-and-additional-msrt-september-release.aspx|title=Operation b79 (Kelihos) and Additional MSRT September Release|last=Microsoft|date=26 September 2011|work=[[Microsoft Technet]]|accessdate=28 April 2012}}</ref> These charges were later dropped when Microsoft determined that the named defendants did not intentionally aid the botnet controllers.<ref name="Latif">{{cite web|url=http://www.theinquirer.net/inquirer/news/2120576/microsoft-drops-kelihos-botnet-allegations-isp-owner|title=Microsoft drops Kelihos botnet allegations against ISP owner|last=Latif|first=Lawrence|date=27 October 2011|work=[[The Inquirer]]|accessdate=28 April 2012}}</ref><ref name="Gonsalves">{{cite web|url=http://www.crn.com/news/security/232500413/microsoft-says-ex-antivirus-maker-ran-botnet.htm|title=Microsoft Says Ex-Antivirus Maker Ran Botnet|last=Gonsalves|first=Antone|date=24 January 2012|work=[[CRN Magazine]]|accessdate=28 April 2012}}</ref>


In January 2012 a new version of the botnet was discovered, one sometimes referred to as Kelihos.b or Version 2,<ref name=Mills/><ref name=Kirk/><ref name="Constantin"/> consisting of an estimated 110,000 infected computers.<ref name=Mills/><ref name="Warren">{{cite web|url=http://www.theverge.com/2012/3/29/2910450/second-kelihos-botnet-disabled-by-security-experts|title=Second Kelihos botnet downed, 116,000 machines freed|last=Warren|first=Tom|date=29 March 2012|work=[[The Verge (website)|The Verge]]|accessdate=28 April 2012}}</ref> During this same month Microsoft pressed charges against Russian citizen Andrey Sabelnikov, a former IT security professional, for being the alleged creator of the Kelihos Botnet [[sourcecode]].<ref name=Gonsalves/><ref name="Brewster">{{cite web|url=http://www.itpro.co.uk/638476/microsoft-suspects-ex-antivirus-worker-of-kelihos-botnet-creation|title=Microsoft suspects ex-antivirus worker of Kelihos botnet creation|last=Brewster|first=Tom|date=24 January 2012|work=IT PRO|accessdate=28 April 2012}}</ref><ref name="Keizer">{{cite web|url=http://www.itworld.com/security/244023/accused-kelihos-botnet-maker-worked-two-security-firms|title=Accused Kelihos botnet maker worked for two security firms &#124; ITworld|last=Keizer|first=Gregg|date=24 January 2012|work=[[ITworld]]|accessdate=28 April 2012}}</ref> The second version of the botnet itself was shut down by it in {{Nowrap|March 2012}} by several privately owned firms by [[DNS sinkhole|sinkholing]] it&nbsp;– a technique which gave the companies control over the botnet while cutting off the original controllers.<ref name=Ortloff/><ref name="Donohue2">{{cite web|url=http://threatpost.com/en_us/blogs/kaspersky-sinkholes-kelihos-botnet-again-expects-resurrection-032812|title=Kaspersky Knocks Down Kelihos Botnet Again, But Expects Return|last=Donohue|first=Brian|date=28 March 2012|work=ThreatPost|accessdate=28 April 2012}}</ref>
In January 2012 a new version of the botnet was discovered, one sometimes referred to as Kelihos.b or Version 2,<ref name=Mills/><ref name=Kirk/><ref name="Constantin"/> consisting of an estimated 110,000 infected computers.<ref name=Mills/><ref name="Warren">{{cite web|url=http://www.theverge.com/2012/3/29/2910450/second-kelihos-botnet-disabled-by-security-experts|title=Second Kelihos botnet downed, 116,000 machines freed|last=Warren|first=Tom|date=29 March 2012|work=[[The Verge (website)|The Verge]]|accessdate=28 April 2012}}</ref> During this same month Microsoft pressed charges against Russian citizen Andrey Sabelnikov, a former IT security professional, for being the alleged creator of the Kelihos Botnet [[sourcecode]].<ref name=Gonsalves/><ref name="Brewster">{{cite web|url=http://www.itpro.co.uk/638476/microsoft-suspects-ex-antivirus-worker-of-kelihos-botnet-creation|title=Microsoft suspects ex-antivirus worker of Kelihos botnet creation|last=Brewster|first=Tom|date=24 January 2012|work=IT PRO|accessdate=28 April 2012}}</ref><ref name="Keizer">{{cite web|url=http://www.itworld.com/security/244023/accused-kelihos-botnet-maker-worked-two-security-firms|title=Accused Kelihos botnet maker worked for two security firms &#124; ITworld|last=Keizer|first=Gregg|date=24 January 2012|work=[[ITworld]]|accessdate=28 April 2012}}</ref> The second version of the botnet itself was shut down by it in {{Nowrap|March 2012}} by several privately owned firms by [[DNS sinkhole|sinkholing]] it&nbsp;– a technique which gave the companies control over the botnet while cutting off the original controllers.<ref name=Ortloff/><ref name="Donohue2">{{cite web|url=http://threatpost.com/en_us/blogs/kaspersky-sinkholes-kelihos-botnet-again-expects-resurrection-032812 |title=Kaspersky Knocks Down Kelihos Botnet Again, But Expects Return |last=Donohue |first=Brian |date=28 March 2012 |work=ThreatPost |accessdate=28 April 2012 |deadurl=yes |archiveurl=https://web.archive.org/web/20120412022707/http://threatpost.com/en_us/blogs/kaspersky-sinkholes-kelihos-botnet-again-expects-resurrection-032812 |archivedate=12 April 2012 |df= }}</ref>


Following the shutdown of the second version of the botnet, a new version surfaced as early as 2 April, though there is some disagreement between research groups whether the botnet is simply the remnants of the disabled Version 2 botnet, or a new version altogether.<ref name="Raywood">{{cite web|url=http://www.scmagazineuk.com/crowdstrike-researchers-deny-that-kelihos-has-spawned-a-new-version/article/234617/|title=CrowdStrike researchers deny that Kelihos has spawned a new version&nbsp;– SC Magazine UK|last=Raywood|first=Dan|date=2 April 2012|work=[[SC Magazine]]|accessdate=29 April 2012}}</ref><ref name="Leyden">{{cite web|url=http://www.theregister.co.uk/2012/03/29/kelhios_bot_not_dead_yet/|title=Kelihos zombies erupt from mass graves after botnet massacre|last=Leyden|first=John|date=29 March 2012|work=[[The Register]]|accessdate=28 April 2012}}</ref> This version of the botnet currently consists of an estimated 70,000 infected computers. The Kelihos.c version mostly infects computers through Facebook by sending users of the website malicious download links. Once clicked, a [[Trojan horse (computing)|Trojan horse]] named Fifesoc is downloaded, which turns the computer into a [[Zombie (computer science)|zombie]], which is part of the botnet.<ref name="SPAMfighter News">{{cite web|url=http://www.spamfighter.com/News-17629-Kelihos-Botnet-Re-emerges-This-Time-Attacking-Social-Networks.htm|title=Kelihos Botnet Re-emerges, This Time Attacking Social Networks|last=SPAMfighter News,|date=13 April 2012|work=SPAMfighter|accessdate=28 April 2012}}</ref>
Following the shutdown of the second version of the botnet, a new version surfaced as early as 2 April, though there is some disagreement between research groups whether the botnet is simply the remnants of the disabled Version 2 botnet, or a new version altogether.<ref name="Raywood">{{cite web|url=http://www.scmagazineuk.com/crowdstrike-researchers-deny-that-kelihos-has-spawned-a-new-version/article/234617/|title=CrowdStrike researchers deny that Kelihos has spawned a new version&nbsp;– SC Magazine UK|last=Raywood|first=Dan|date=2 April 2012|work=[[SC Magazine]]|accessdate=29 April 2012}}</ref><ref name="Leyden">{{cite web|url=http://www.theregister.co.uk/2012/03/29/kelhios_bot_not_dead_yet/|title=Kelihos zombies erupt from mass graves after botnet massacre|last=Leyden|first=John|date=29 March 2012|work=[[The Register]]|accessdate=28 April 2012}}</ref> This version of the botnet currently consists of an estimated 70,000 infected computers. The Kelihos.c version mostly infects computers through Facebook by sending users of the website malicious download links. Once clicked, a [[Trojan horse (computing)|Trojan horse]] named Fifesoc is downloaded, which turns the computer into a [[Zombie (computer science)|zombie]], which is part of the botnet.<ref name="SPAMfighter News">{{cite web|url=http://www.spamfighter.com/News-17629-Kelihos-Botnet-Re-emerges-This-Time-Attacking-Social-Networks.htm|title=Kelihos Botnet Re-emerges, This Time Attacking Social Networks|last=SPAMfighter News,|date=13 April 2012|work=SPAMfighter|accessdate=28 April 2012}}</ref>

Revision as of 23:05, 3 May 2017

The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of bitcoins.[1]

History

The Kelihos botnet was first discovered around December 2010.[2] Researchers originally suspected having found a new version of either the Storm or Waledac botnet, due to similarities in the modus operandi and source code of the bot,[3][4] but analysis of the botnet showed it was instead a new, 45,000-infected-computer-strong, botnet that was capable of sending an estimated 4 billion spam messages a day.[5][6] In September 2011[7] Microsoft took down the botnet in an operation codenamed "Operation b79".[5][8] At the same time, Microsoft filed civil charges against Dominique Alexander Piatti, dotFREE Group SRO and 22 John Doe defendants for suspected involvement in the botnet for issuing 3,700 subdomains that were used by the botnet.[8][9] These charges were later dropped when Microsoft determined that the named defendants did not intentionally aid the botnet controllers.[10][11]

In January 2012 a new version of the botnet was discovered, one sometimes referred to as Kelihos.b or Version 2,[1][6][7] consisting of an estimated 110,000 infected computers.[1][12] During this same month Microsoft pressed charges against Russian citizen Andrey Sabelnikov, a former IT security professional, for being the alleged creator of the Kelihos Botnet sourcecode.[11][13][14] The second version of the botnet itself was shut down by it in March 2012 by several privately owned firms by sinkholing it – a technique which gave the companies control over the botnet while cutting off the original controllers.[2][15]

Following the shutdown of the second version of the botnet, a new version surfaced as early as 2 April, though there is some disagreement between research groups whether the botnet is simply the remnants of the disabled Version 2 botnet, or a new version altogether.[16][17] This version of the botnet currently consists of an estimated 70,000 infected computers. The Kelihos.c version mostly infects computers through Facebook by sending users of the website malicious download links. Once clicked, a Trojan horse named Fifesoc is downloaded, which turns the computer into a zombie, which is part of the botnet.[18]

On 24 November 2015 a Kelihos botnet event occurred causing widespread false positives of blacklisted IPs:

″November 24, 2015 Widespread false positives

Earlier today, a very large scale Kelihos botnet event occurred - by large scale, many email installations will be seeing in excess of 20% kelihos spam, and some will see their inbound email volume jump by a volume of as much as 500%. This isn't an unusual thing normally, the CBL/XBL has been successfully dealing with large scale Kelihos spam spikes like this, often daily, for years.

The email was allegedly from the US Federal Reserve, saying something about restrictions in "U.S. Federal Wire and ACH online payments." Not only was the notice itself fraudulent, the attached Excel spreadsheet (.xls) contained macro instructions (a downloader) to download a Windows executable virus, most likely Dyreza or Dridex malware.

The detection rules initially deployed by the CBL unfortunately were insufficiently detailed, and listed a number of IP addresses in error.″ [19]

Structure, operations and spread

The Kelihos botnet is a so-called peer-to-peer botnet, where individual botnet nodes are capable of acting as command-and-control servers for the entire botnet. In traditional non-peer-to-peer botnets, all the nodes receive their instructions and "work" from a limited set of servers – if these servers are removed or taken down, the botnet will no longer receive instructions and will therefore effectively shut down.[20] Peer-to-peer botnets seek to mitigate that risk by allowing every peer to send instructions to the entire botnet, thus making it more difficult to shut it down.[2]

The first version of the botnet was mainly involved in denial-of-service attacks and email spam, while version two of the botnet added the ability to steal Bitcoin wallets, as well as a program used to mine bitcoins itself.[2][21] Its spam capacity allows the botnet to spread itself by sending malware links to users in order to infect them with a Trojan horse, though later versions mostly propagate over social network sites, in particular through Facebook.[16][22]

See also

References

  1. ^ a b c Mills, Elinor (28 March 2012). "110,000 PC-strong Kelihos botnet sidelined". CNET. Retrieved 28 April 2012.
  2. ^ a b c d Ortloff, Stefan (28 March 2012). "FAQ: Disabling the new Hlux/Kelihos Botnet". Securelist.com. Retrieved 28 April 2012.
  3. ^ Adair, Steven (30 December 2010). "New Fast Flux Botnet for the Holidays: Could it be Storm Worm 3.0/Waledac 2.0?". Shadowserver. Retrieved 28 April 2012.
  4. ^ Donohue, Brian (29 March 2012). "Kelihos Returns: Same Botnet or New Version?". Threatpost. Archived from the original on 4 April 2012. Retrieved 28 April 2012. {{cite web}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  5. ^ a b Mills, Elinor (27 September 2011). "Microsoft halts another botnet: Kelihos". CNet. Retrieved 28 April 2012.
  6. ^ a b Kirk, Jeremy (1 February 2012). "Kelihos botnet, once crippled, now gaining strength". Network World. Archived from the original on 5 September 2012. Retrieved 28 April 2012. {{cite web}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  7. ^ a b Constantin, Lucian (28 March 2012). "Security Firms Disable the Second Kelihos Botnet". PCWorld. Retrieved 28 April 2012.
  8. ^ a b Boscovich, Richard (27 September 2011). "Microsoft Neutralizes Kelihos Botnet, Names Defendant in Case". Microsoft TechNet. Retrieved 28 April 2012.
  9. ^ Microsoft (26 September 2011). "Operation b79 (Kelihos) and Additional MSRT September Release". Microsoft Technet. Retrieved 28 April 2012.
  10. ^ Latif, Lawrence (27 October 2011). "Microsoft drops Kelihos botnet allegations against ISP owner". The Inquirer. Retrieved 28 April 2012.
  11. ^ a b Gonsalves, Antone (24 January 2012). "Microsoft Says Ex-Antivirus Maker Ran Botnet". CRN Magazine. Retrieved 28 April 2012.
  12. ^ Warren, Tom (29 March 2012). "Second Kelihos botnet downed, 116,000 machines freed". The Verge. Retrieved 28 April 2012.
  13. ^ Brewster, Tom (24 January 2012). "Microsoft suspects ex-antivirus worker of Kelihos botnet creation". IT PRO. Retrieved 28 April 2012.
  14. ^ Keizer, Gregg (24 January 2012). "Accused Kelihos botnet maker worked for two security firms | ITworld". ITworld. Retrieved 28 April 2012.
  15. ^ Donohue, Brian (28 March 2012). "Kaspersky Knocks Down Kelihos Botnet Again, But Expects Return". ThreatPost. Archived from the original on 12 April 2012. Retrieved 28 April 2012. {{cite web}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  16. ^ a b Raywood, Dan (2 April 2012). "CrowdStrike researchers deny that Kelihos has spawned a new version – SC Magazine UK". SC Magazine. Retrieved 29 April 2012.
  17. ^ Leyden, John (29 March 2012). "Kelihos zombies erupt from mass graves after botnet massacre". The Register. Retrieved 28 April 2012.
  18. ^ SPAMfighter News, (13 April 2012). "Kelihos Botnet Re-emerges, This Time Attacking Social Networks". SPAMfighter. Retrieved 28 April 2012.{{cite web}}: CS1 maint: extra punctuation (link)
  19. ^ http://www.abuseat.org
  20. ^ Grizzard, Julian; David Dagon; Vikram Sharma; Chris Nunnery; Brent ByungHoon Kang (3 April 2007). "Peer-to-Peer Botnets: Overview and Case Study". The Johns Hopkins University Applied Physics Laboratory. Retrieved 28 April 2012.
  21. ^ SPAMfighter (5 April 2012). "Security Companies Take Down Kelihos Botnet of Version 2". SPAMfighter. Retrieved 28 April 2012.
  22. ^ Jorgenson, Petra (6 April 2012). "Kelihos Botnet Could Resurge via Facebook Worm". Midsize Insider. Retrieved 29 April 2012.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Kelihos_botnet&oldid=778569035"