Ponmocup – A giant hiding in the shadows

The report profiles the Ponmocup botnet (Vundo/Virtumonde) as a long-lived, sophisticated financially-motivated malware operation: Fox-IT estimates ~15 million cumulative infections, a peak of 2.4 million systems and roughly 500,000 active infections, operated by experienced (likely Russian-speaking) actors who maintain a complex distributed infrastructure to avoid detection and maximize financial gain.