Microsoft-led raids disrupt 'some of the worst' Zeus botnets
Connecting state and local government leaders
The company's Digital Crimes Unit, with an assist from the U.S. Marshals Service, confiscates servers and IP addresses and files civil charges against 39 unknown defendants.
Microsoft, with an assist from U.S. Marshals Service, has disrupted several botnets that use variants of the Zeus malware, confiscating two command-and-control servers and two IP addresses and filing civil charges against 39 unknown defendants.
The company’s Digital Crimes Unit, along with representatives from financial organizations, raided office buildings in Scranton, Pa., and Lombard, Ill., where the servers hosted what Microsoft called “some of the worst” known Zeus botnets.
In addition to the two IP addresses used in the botnets’ command and control structure, Microsoft also is monitoring 800 Web domains used in the botnets, which could help identify and clean computers infected with Zeus, Microsoft said in a blog post describing the raids.
Related stories:
FBI takes over Rustock botnet investigation, aims for ringleader
After phishing crackdown, cyberattackers switch weapons
The raids are the latest in Microsoft’s efforts to combat online fraud. In 2011, the company led a takedown of the massive Rustock botnet, which had infected more than 1.5 million computers worldwide, and later turned the case over to the FBI. It also broke up the widespread Kelihos and Walladec botnets.
Microsoft and its partners, including the Financial Services-Information Sharing and Analysis Center and NACHA-The Electronic Payments Association, filed suit March 19 in federal court for the Eastern District of New York against John Does 1-39 (who operate online under aliases) in connection with the botnets. The company subsequently obtained a court order for the raids, which were carried out March 23, escorted by U.S. Marshals.
Zeus is a Trojan horse often spread by phishing e-mails that has been used to steal personal information and access bank accounts and other financial systems information since 2007. Sold in the underground market as a malware kit, it has been used for attacks in nearly 200 countries and thousands of organizations, including the U.S. Transportation Department and NASA.
In the latest crackdown, Microsoft and its partners targeted botnets using “Zeus, SpyEye and Ice-IX variants of the Zeus family of malware, known to cause the most public harm and which experts believe are responsible for nearly half a billion dollars in damages,” the company’s blog post said.
Because the targets were complex, the investigation, known as Operation b71, wasn’t intended to permanently shut down operations, as was the goal of the other high-profile takedowns. “Rather, our goal was a strategic disruption of operations to mitigate the threat in order to cause long-term damage to the cyber criminal organization,” the company said.
Microsoft’s active role in going after criminal operations is led by Richard Boscovich, a senior lawyer in the Digital Crimes Unit and a former federal prosecutor in Miami, the New York Times reported.
Boscovich developed the strategy for targeting botnet operators, which includes the premise that the fake e-mails used to lure victims violate Microsoft’s trademarks, the Time reported.
Along with FS-ISAC and NACHA, Microsoft’s complaint is supported by Kyrus Tech, the company said. Security company F-Secure also provided information in support of the case.