Cybercriminals have taken control of almost 12-million new IP addresses since January, a 50% increase since 2008.
This is one of the findings from McAfee's first quarter threat report, which also reveals that the US is now home to the largest percentage of botnet-infected computers, hosting 18% of all zombie machines.
Cybercriminals are building an army of infected, "zombie" computers to recover from last November's takedown of a central spam-hosting ISP, according to the new report from Avert Labs.
The November 2008 takedown of McColo dropped spam levels by an estimated 60%, but spam quantities are rising as cybercriminals create new ways to send bulk e-mails. The quick expansion of botnets threatens to boost spam levels back up. In fact, spam volumes have already recovered about 70% since McColo went offline.
Compared with the same quarter a year ago, spam volumes are 20% lower in 2009 and 30% below the third quarter of 2008, which had the highest quarterly volumes recorded to date.
"The massive expansion of these botnets provides cybercriminals with the infrastructure they need to flood the Web with malware," says Jayson O'Reilly, regional manager for Africa, McAfee. "Essentially, this is cybercrime enablement."
Other key findings of the research are:
* The Koobface virus has made a resurgence, and more than 800 new variants of the virus were discovered in March alone;
* Servers hosting legitimate content have increased in popularity with malware writers to distribute malicious and illegal content;
* Cybercriminals are increasing their use of URL redirects and Web 2.0 sites to disguise their location; and
* Compared to the overall landscape, the Conficker worm represents a small subset of all threat reports. Autorun malware, a vector used by certain Conficker variants, represented only 10% of all detections reported during the first quarter.