There's a good news/bad news update on the rogue ISP McColo and last week's coordinated effort to drive the malware faucet offline. The good news is, the ISP has (mostly) stayed offline, and spam levels a week later are still running significantly lower than they had been. The impact of taking McColo offline seems to have reverberated longer than what we saw from the Atrivo takedown back in September. When Atrivo shut off, spam levels fell, but rapidly climbed back to near-original levels. Post-McColo spam counts have remained lower for the last eight days, but may unfortunately be on the verge of climbing again.

That's where the bad news comes in. McColo, it turns out, had previously negotiated the rights to a backup internet connection with Swedish ISP TeliaSonera. Once its own connection to the Internet was severed, McColo bided its time until Saturday, at which point it flipped a switch, reconnected via TeliaSonera, and began frantically updating its C&C servers, aiming them at new targets within our old friend, the Russian Business Network (RBN).