Flashback botnet not shrinking, huge numbers of Macs still infected

20.04.2012
Contrary to reports by several security companies, the Flashback botnet is not shrinking, the Russian antivirus firm that first reported the massive infection three weeks ago claimed today.

Dr. Web, which earlier this month was the first to report the largest-ever successful malware attack against Apple's OS X, said Friday that the pool of Flashback-infected Macs still hovers around the 650,000 mark, and that infections are continuing.

Also on Friday, Liam O Murchu, director of operations at Symantec's security response center, confirmed that Dr. Web's numbers were correct.

Both Dr. Web's tally and its contention that infections are ongoing flew in the face of other antivirus companies' assertions. Kaspersky Lab and Symantec, which have each "sinkholed" select domains -- hijacked them before the hackers could use them to issue orders to compromised machines -- used those domains to count the Macs that try to communicate with the malware's command-and-control centers.

Earlier this week, Symantec said the and was down to 142,000 machines. Yesterday, Kaspersky claimed that its count registered only 30,000 infected Macs.

Not even close, said Dr. Web in a Friday .