May 5, 2015 By Shane Schick 2 min read

It’s easy to hate spammers, but not if they are unwitting victims of cybercrime, like those affected by the recently discovered Mumblehard malware.

ESET researchers first raised awareness about the Mumblehard malware on their blog, We Live Security. The Linux-built malware consists of a back door and a spamming daemon that sends large batches of junk email content. The team reports the botnet has been quietly running on infected machines for more than five years and has doubled in size over the last six months.

The revelations of this security risk could be a blow to the open source community, which has already been reeling from major flaws like 2014’s Heartbleed and Shellshock bugs. As DecryptedTech noted, there has long been a perception among IT professionals that Linux, BSD and similar platforms are more secure than their proprietary counterparts. As more Mumblehard malware is uncovered, that perception may change radically.

In fact, Ars Technica likened Mumblehard malware to Windigo, a spam botnet that was also discovered by ESET researchers and reportedly connected to thousands of Linux servers to spread unsolicited messages. In this case, though, Mumblehard seems more sophisticated because the Perl script it’s based on is concealed in a low-level programming language known as a “packer.” That’s why it may have been running undetected for last half-decade.

Then there’s the rate of infection itself. Experts believe the Mumblehard malware isn’t constantly sending spam but operates more intermittently to avoid drawing attention to itself. According to Help Net Security, it also seems to be associated with Yellsoft, whose DirectMailer system allows customers to send anonymous email messages.

The designer of the Mumblehard malware has been keeping a close watch on platforms that offer easy access. In its coverage of the story, The Register said the botnet takes advantage of content management tools such as Joomla and WordPress, the latter of which has been riddled with security problems in recent months.

The real question, of course, is whether filling up inboxes with spam is the worst of what the Mumblehard malware has to offer or if it also steals data or breaks into admin controls of the machines it infects. Although it managed to stay under the radar for a long time, hopefully it won’t take nearly as long to clean up whatever damage it has caused.

More from

CISA releases landmark cyber incident reporting proposal

2 min read - Due to ongoing cyberattacks and threats, critical infrastructure organizations have been on high alert. Now, the Cybersecurity and Infrastructure Security Agency (CISA) has introduced a draft of landmark regulation outlining how organizations will be required to report cyber incidents to the federal government.The 447-page Notice of Proposed Rulemaking (NPRM) has been released and is open for public feedback through the Federal Register. CISA was required to develop this report by the Cyber Incident Reporting for Critical Infrastructure Act of 2022…

Ransomware payouts hit all-time high, but that’s not the whole story

3 min read - Ransomware payments hit an all-time high of $1.1 billion in 2023, following a steep drop in total payouts in 2022. Some factors that may have contributed to the decline in 2022 were the Ukraine conflict, fewer victims paying ransoms and cyber group takedowns by legal authorities.In 2023, however, ransomware payouts came roaring back to set a new all-time record. During 2023, nefarious actors targeted high-profile institutions and critical infrastructure, including hospitals, schools and government agencies.Still, it’s not all roses for…

What should an AI ethics governance framework look like?

4 min read - While the race to achieve generative AI intensifies, the ethical debate surrounding the technology also continues to heat up. And the stakes keep getting higher.As per Gartner, “Organizations are responsible for ensuring that AI projects they develop, deploy or use do not have negative ethical consequences.” Meanwhile, 79% of executives say AI ethics is important to their enterprise-wide AI approach, but less than 25% have operationalized ethics governance principles.AI is also high on the list of United States government concerns.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today