The botnet is grown when users unwittingly install a malicious game app that contains the SpamSoldier trojan – malware capable of blocking incoming and outgoing texts from unknown numbers in case users or mobile service providers try to alert victims of their spamming. RSA researchers found that Carberp perpetrators began offering the trojan again in December; it had been sold last in February 2011 in closed online forums for $10,000. The botnet, among the world’s largest banking networks detected at that time, was believed to have caused $4.5 million in loses as of 2011, primarily impacting users in Russia.