Summary
ngCERT has identified a malware tagged Necurs, a family of malware containing rootkit capabilities that was used to form one of the world’s largest criminal botnets. Necurs has both a user and kernel mode component used to access systems at the root level and dynamically load additional modules. It is distributed via exploit kits as well as through other malware such as the Zeus Trojan and has been used to deliver Dridex trojan and Locky malware through spam campaigns. Enforcing a strong password policy and implementing regular password changes as well as enabling a personal firewall on workstation could mitigate Necurs malware effects.
Description & Consequence
NECURS is an email spam botnet responsible for delivering numerous other popular malwares. It spread through malicious email attachments containing infected Microsoft Word or Excel macros, exploit kits, or malicious links. Once a system is compromised, NECURS installed its kernel-mode rootkit, enabling it to disable security tools, resist removal, and ensure persistence. The infected endpoint then becomes part of the NECURS botnet, which could be controlled remotely to send spam, deliver secondary payloads, or participate in DDoS campaigns. Beyond spam distribution, NECURS was used to facilitate pump-and-dump stock scams, cryptocurrency mining, and even targeted ransomware campaigns. Its adaptability and criminal business model made it a cornerstone of the cybercrime ecosystem for nearly a decade.
Successful exploitation of this botnet could lead to:
- Data Theft and Financial Loss.
- Ransomware Deployment.
- System Compromise and Resource Hijacking.
- Spread of Additional Malware.
- Operational Disruption.
- Reputational Damage.
Solution
SOLUTIONS/MITIGATIONS
- Maintain updated antivirus and anti-malware solutions.
- Educate users on phishing and suspicious email attachments.
- Implement network-level protections and monitor for unusual traffic.
- Conduct regular system scans and patch vulnerabilities promptly.
- Isolate and remediate infected systems immediately to prevent spread.
Reference
Revision
