When we last wrote about the Storm Worm in September, Heise Security had noted that the growing botnet had not yet been used for much, but could be a threat in the future. "[A]lthough the network has so far been primarily used to send spam, it could also be used for DDoS attacks on businesses or even countries," said Heise. Since then, Heise's prediction has come true; the worm now attacks those who publish new information on the inner workings of the worm. Researchers are allegedly "running scared" from the worm, which seemingly has a sentient ability to detect and attack whoever threatens it.

IBM/ISS host-protection architect Josh Korman told Interop New York conference attendees this week that the worm has the ability to see who is probing its servers and launch a DDoS attack on that IP as retaliation. As a result, some researchers are afraid to publish any of their findings about the worm for fear of even harsher retaliation. "As you try to investigate [Storm], it knows, and it punishes," Korman said, as recounted by Network World. "It fights back."

Since its inception early this year, the Storm Worm has been spreading like wildfire. It first came as spam e-mail and claimed to provide information on storms going on in Europe, but soon began to morph into many different forms—presumably to avoid easy tracking. In almost every instance, the worm sent spam that contained a link, which would then infect the user's computer in order to send more spam. It appeared as if the worm's only purpose was to get as many computers as possible as part of its massive botnet, which (as we now know) is used to launch DDoS attacks.

There has been some level of debate over just how serious the Storm Worm's threat really is, and whether the botnet is as big as some researchers claim. Some had estimated that up to 15 million computers had become part of the Storm Worm's botnet, but others disagree, citing numbers in the hundreds of thousands. Detractors also point out that awareness of the worm allowed antivirus and malware-removal programs to target the worm in recent months, cutting down the number of infected computers even further. Indeed, Microsoft's anti-malware team added the Storm Worm to its Malicious Software Removal Tool on September 11. That update was pushed out to millions of Windows users and eliminated many infected nodes almost overnight.

Just last week, UC San Diego network security expert Brandon Enright told ToorCon conference-goers that his most recent data showed the Storm Worm sitting at a mere 20,000 computers, according to IDG. He did, however, note that he too was subject to a DDoS attack from the Storm Worm some time ago after having researched it just a little too much.