Nugache worm kicking up a Storm

Although the infamous Storm worm enters 2008 with a reputation as the world's most dangerous botnet, security experts say there's an up-and-comer called Nugache that could give it a run for its money.

Nugache was first sighted about two years ago as a worm designed to work with chat protocols, says Paul Henry, vice president of technology evangelism at Secure Computing. As such, it did not propagate virulently. But last month, hackers believed to be tied to the notorious Russian Business Network online criminal mob gave Nugache a facelift, copying many of the successful attributes of Storm, such as encryption, a rootkit and the ability to spread as web-borne malware.

"It's following the Storm worm," Henry says. "Nugache now includes the ability to encrypt itself and every version that rolls out is generated a bit differently to obfuscate detection."

Nugache is now also peer-to-peer controlled to put it under a more decentralised command-and-control structure that makes it difficult to take down the botnet it can construct once it infects desktop machines.