About 75,000 personal computers in almost 2,500 companies and government agencies across the globe have been caught in a botnet uncovered by a researcher at the US-based NetWitness network forensics firm. Hackers were able to collect logins and passwords for Facebook, Yahoo, Hotmail and other accounts, including online banking sites. They were also able to access some corporate servers used to store confidential data, including one used for processing credit-card payments.

Companies reportedly attacked include Paramount Pictures, Merck, Juniper Networks and Cardinal Health in the US, but affected computers in more than 200 countries including Egypt, Mexico, Saudi Arabia, Turkey. The Wall Street Journal reported that Merck and Cardinal Health said they had isolated and contained the problem, and Merck said "no sensitive information was compromised".

NetWitness's Alex Cox uncovered the botnet while installing monitoring software to help a large corporation deal with cyberattacks. He found a 75GB cache of data generated by the botnet, which NetWitness has called Kneber after a username linking the infected systems. NetWitness said in a statement: "Disturbingly, the data was only a one-month snapshot of data from a campaign that has been in operation for more than a year."

The PCs in question, almost all running Microsoft Windows XP or Vista, had been compromised by a new variant of the well-known ZeuS Trojan, which is one of the "top five" in its class. Cox told the SearchSecurity.com site that the variant used in the latest attacks had a detection rate of less than 10% among antivirus software. The botnet communication was also shielded from detection by existing intrusion detection systems.

"This is not about a single piece of malware on 75,000 machines, it's about how bad the security industry is responding to these incidents and how bad the problem is," said Cox.

SearchSecurity.com said "the cybercriminals exploited vulnerabilities in Adobe Flash as well as holes in Adobe Reader and Acrobat using malicious PDF applications in spear phishing attacks, according to Cox. They also used exploit kits to set up drive-by attacks to infect victims."

The discovery of the Kneber botnet follows publicity about attempts to penetrate Google and other companies, dubbed Operation Aurora. In this case, the botnet command centre appears to have been in Germany, while ZeuS appears to be mainly the work of cybercriminals based in Eastern Europe. ZeuS is often used to collect data from online forms, including names, dates of birth, and account names and passwords, and one special feature is that it can work with the Firefox web browser.

Amit Yoran, chief executive of NetWitness and former Director of the National Cyber Security Division, said: "While Operation Aurora shed light on advanced threats from sponsored adversaries, the number of compromised companies and organizations pales in comparison to this single botnet. These large-scale compromises of enterprise networks have reached epidemic levels. Cyber criminal elements, like the Kneber crew quietly and diligently target and compromise thousands of government and commercial organizations across the globe. Conventional malware protection and signature based intrusion detection systems are by definition inadequate for addressing Kneber or most other advanced threats."

NetWitness also said that "over half the machines infected with Kneber also were infected with Waledac, a peer to peer botnet." This suggests some level of co-existence if not active cooperation between cybercriminals, where a PC could continue to operate in one botnet even if the other was found and removed. Earlier this month, there was a small "botnet war" after the upstart Spy Eye appeared with a feature called Kill Zeus. This aims to remove ZeuS from the victim's PC, giving Spy Eye exclusive access. However, by far the biggest and best botnet is still Conficker, with more than 5m PCs.