The Demon Necurs, High Priest of Spam

Legend

Active from around 2012, Necurs was one of the largest spam botnets ever seen: it infected more than nine million computers and poured waves of Dridex, Locky ransomware and pump-and-dump stock scams onto the world. In March 2020 Microsoft obtained a US court order to seize its infrastructure, pre-empting the domains its algorithm would generate. It has been almost silent since.

Exorcism

Cast it out by filtering spam and malicious attachments at the mail gateway. Block known DGA domains and keep computers patched and monitored, because every zombie PC is one more pulpit for its sermons.

Technical record

Circle

Circle II · Legions (botnets) · Circle III · Ransomware and extortion · Circle VI · Banking trojans and infostealers

First seen

c. 2012

Status

Dormant

One of the largest spam botnets, active from about 2012, which infected over nine million computers and distributed Dridex, Locky ransomware and fraud spam. Microsoft obtained a US court order in March 2020 to seize its infrastructure and pre-empt its domain generation algorithm. It has been largely inactive since.