Gamut Botnet

The Gamut Botnet is a decentralized network of Trojans specializing in sending spam, particularly with 'job offer' themes. The Trojan also may distribute itself with similar spamming activities, and users should be careful of potentially corrupted e-mail attachments that could carry the Trojan's installer. Standard anti-malware programs should counter this threat sufficiently and remove the Gamut Botnet's client from the computer.

When Work isn't All that It's Cracked Up to Be

Years of Web history show the many dangers of opening an e-mail link or file without the right precautions. However, some Trojans still are succeeding at these classic attacks despite the public being as informed as possible. The Gamut Botnet, a years-seasoned Trojan network, is another warning tale of e-mail perils, and in more than one way. Besides circulating through it, the Trojan also ropes its victims into helping with the same attacks.

Infection vectors for clients of the Gamut Botnet are, usually, spam-based. The usually-random victim opens an e-mail attachment that may disguise itself with various tactics, most typically, as a document. Trojan downloaders are the normal go-betweens in this operation, which install the Trojan after they trigger through macro abuses and other exploits. The Gamut Botnet also has not-insignificant anti-analysis and anti-sandbox checks during its installation, although it's a well-known and analyzed threat, at this date.

The Gamut Botnet is a dedicated spamming network, and most of its features revolve around this activity. In-between sleep cycles, it contacts its C&C for e-mails for spamming and sends messages through port 25. The spam may include different attacks besides the previous one, such as harvesting e-mails addresses with fake job offer websites (the botnet's overall favorite theme) or soliciting ransoms through sex-themed extortion threats. The infected Windows computer is, accordingly, 'recruited' into the network for furthering the same attacks that victimized it.

Staying Out of One of the Largest Botnets to Date

The Gamut Botnet began its younger years with control of just five percent of the spamming traffic around the Web. By now, it's a full-fledged competitor to stiff competition like the Necurs Botnet and the StealRat botnet. Although it has few attacks that harm the 'zombified' PC directly, it represents a non-consensual use of hardware and network resources for furthering mostly-illegal activities. Users can protect themselves through standard e-mail security practices, such as:

• Enabling extension visibility will help with determining correct filenames and their formats.
• Scanning attachments and links with appropriate security software will limit your exposure to unsafe Web content.
• Updating software with all security patches will remove remote code execution, buffer overflow and other exploits.
• Deactivating macros in your documents and spreadsheets will further limit threat-downloading attacks.

You should always doublecheck links for legitimacy. Corrupted links may use tricks such as having blue text that doesn't match the URL or typo-squatting (using domain names that are visibly-similar to another domain, such as 'Google' versus 'Gooqle').
Fake job and career offers make up the majority, if not the whole, of the Gamut Botnet's tactics. The usual anti-malware products also should protect your PC and remove the Gamut Botnet's Trojan.

The Gamut Botnet is an enduring legacy of spam-based attacks turning into profit on the dark Web. Anyone wanting to put that profitable history to rest will have to mind their e-mails so that a Trojan doesn't make their PCs part of the story.