One of our handlers said that he saw a significant spike in botnet activity to known CCs yesterday.  That would make sense, considering the millions of new computers that joined the Internet soup on Christmas day, right out of the box, and likely a few months behind on patches.  However, when we looked at our favorite botnet tracking site, ShadowServer, we see that there was just the opposite - a bit DROP in botnets on Christmas Eve and very little rise on Christmas Day.  Very odd.

So, what are your sensors seeing?  A rise in botnet activity or a drop?  Send us your observations via our contact page.

Marcus H. Sachs
Director, SANS Internet Storm Center