Security experts at Palo Alto Networks published a detailed analysis of the architecture used to spread the Ursnif banking Trojan worldwide. The researchers have focused their investigation on the spam botnet used to send the malicious emails and the network compromised web servers used to host the malicious code. The experts discovered that crooks copied their malicious files on multiple servers making their infrastructure redundant. Most were compromised personal or small-to-medium-sized business websites in Europe, which havent been maintained for years.”]
Source: http://securityaffairs.co/wordpress/56473/cyber-crime/ursnif-banking-trojan-botnet.html