Kneber botnet hit 374 U.S. firms, gov't agencies
Rival cyber gangs may be teaming up in cyberattacks, says NetWitness
Computerworld - Of the nearly 2,500 companies worldwide that have been affected by the Kneber botnet, 374 of them are U.S.-based organizations, according to NetWitness Corp., the company that uncovered the botnet attack last month.
The list of compromised entities in the U.S includes Fortune 500 companies, local, state and federal government agencies, energy companies, ISPs and educational institutions. A total of nearly 75,000 computers worldwide are believed to have been compromised by the botnet, according to NetWitness.
A 75GB cache of stolen data shows that the botnet, which is a variant of Zeus, has been used to steal a wide range of information, including tens of thousands of login credentials -- mainly for financial accounts. The recovered data appears to be one month's worth of information from the botnet's command-and-control servers NetWitness said.
In addition to banking information, the Kneber bot also appears to be designed to harvest other kinds of information, suggesting that Zeus is being put to broader uses than just stealing banking credentials.
NetWitness has so far refused to identify the companies whose machines have been compromised in the worldwide attack. But the Wall Street Journal listed Merck & Co., Cardinal Health Inc., Paramount Pictures and Juniper Networks Inc. as four companies that had been affected.
Alex Cox, the principal analyst at NetWitness who discovered the Kneber bot, said today that not all of the companies affected by it were victims of a targeted attack. In some cases, enterprise systems were compromised as a result of drive-by downloads; in other cases, companies appear to have been targeted by spear-phishing campaigns designed to get individuals to open e-mails with malicious links and attachments.
That suggests that the botnet is being used by multiple groups with different objectives in mind, Cox said.
The data uncovered by NetWitness involved Kneber botnet activity between December 2009 and last month and shows that, in many cases, systems were compromised via a since-patched vulnerability affecting Adobe's PDF reader, Cox said.
Cox also noted that the Kneber botnet appears to have been designed to be more resilient to takedown attempts. More than half the machines infected with Kneber are also infected with a peer-to-peer bot called Waledac. While it is not unusual for compromised systems to have multiple strains of malware, in this case the Kneber bot appears to be actively logging Waledac activity and actually downloading Waledac to machines it has infected, Cox said.
"Either the Zeus guys are the same guys that are running Waledac, or there is some inter-gang cooperation going on," he said.
The effort to have two different bots, each with its own command-and-control infrastructure, running on one system is significant, Cox said. "If I take down the command-and-control structure of Zeus, Waledac is still running so I can use it to push Zeus back" onto infected systems, he said. "At the very least, two separate botnet families with different [command-and-control] structures can provide fault tolerance and recoverability in the event that one mechanism is taken down by security efforts," Cox said in a report detailing the Kneber botnet.
An analysis of IP addresses, domains and registration information shows that the servers being used to serve up Kneber-related malware are globally dispersed, Cox said. While many of the servers appear to be based in China, some are located in the Ukraine, Korea, Panama and the U.S.
Meanwhile, the registration information for the domain from which NetWitness recovered the stolen data cache includes an e-mail address that is associated with money-mule recruitment activity. The registrant contact is listed as having a street address in Virginia.
Money mules are people who are used (often without their knowledge) by cybercriminals to accept and launder stolen money.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
- Russian credential theft shows why the password is dead
- Cybersecurity should be professionalized
- Feds declare big win over Cryptolocker ransomware
- Hackers hit more businesses through remote access accounts
- P.F. Chang's post-breach move to manual processing is telling
- Microsoft withholds monster IE update from Windows 8.1 dawdlers
- In baffling move, TrueCrypt open-source crypto project shuts down
- 'Oleg Pliss' hack makes for a perfect teachable IT moment
- Give IE the heave-ho until Microsoft patches zero-day
- Hackers find first post-retirement Windows XP-related vulnerability
Read more about Security in Computerworld's Security Topic Center.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- The business impact of BYOA: Five major challenges and how your enterprise can solve them This E-Book reviews five major challenges of BYOA with key subject matter experts and outlines how businesses can solve them.
- BYOA: Embracing the Opportunity, Controlling the Risk This whitepaper explores the shift from BYOD to BYOA (bring-your-own-application) and how IT departments today can address this new change in the IT...
- Learn More About Peer 1 Hosting's Mission Critical Cloud Mission Critical Cloud from Peer 1 Hosting is enterprise-ready, creating a perfect point of adoption whether you need an off-premise solution for development
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade.
- Peer 1's Mission Critical Cloud: Your Cloud, Your Way Peer 1 Hosting's Mission Critical Cloud offers the ultimate in flexible customization of infrastructure, resources and support. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!