Botconf 2021

Ponmocup is one of the most successful and longest running botnets of the past decade. First detected in 2006, as Vundo or Virtumonde, and detected as Ponmocup starting in 2011, we believe this is one of the most underestimated botnets still under continuous development.

Though Ponmocup has received a minimal amount of attention from the security community, it is in fact a sophisticated botnet serving different purposes. Though these purposes have often been described as low-risk functionalities, the malware is actually used by a group of sophisticated criminals who use the botnet for various (financials) gains, and are likely conducting a limited amount of targeted attacks.

The whitepaper aims to provide a complete time-line and unique insight into the modus operandi of the operation around Ponmocup and describes all the important details of the malware, including as yet unknown indicators of compromise, both on host and network level, which previous research has only scratched the surface of.