Kneber botnet hit 374 U.S. firms, gov't agencies

Computerworld - Of the nearly 2,500 companies worldwide that have been affected by the Kneber botnet, 374 of them are U.S.-based organizations, according to NetWitness Corp., the company that uncovered the botnet attack last month.

The list of compromised entities in the U.S includes Fortune 500 companies, local, state and federal government agencies, energy companies, ISPs and educational institutions. A total of nearly 75,000 computers worldwide are believed to have been compromised by the botnet, according to NetWitness.

A 75GB cache of stolen data shows that the botnet, which is a variant of Zeus, has been used to steal a wide range of information, including tens of thousands of login credentials -- mainly for financial accounts. The recovered data appears to be one month's worth of information from the botnet's command-and-control servers NetWitness said.

In addition to banking information, the Kneber bot also appears to be designed to harvest other kinds of information, suggesting that Zeus is being put to broader uses than just stealing banking credentials.

NetWitness has so far refused to identify the companies whose machines have been compromised in the worldwide attack. But the Wall Street Journal listed Merck & Co., Cardinal Health Inc., Paramount Pictures and Juniper Networks Inc. as four companies that had been affected.

Alex Cox, the principal analyst at NetWitness who discovered the Kneber bot, said today that not all of the companies affected by it were victims of a targeted attack. In some cases, enterprise systems were compromised as a result of drive-by downloads; in other cases, companies appear to have been targeted by spear-phishing campaigns designed to get individuals to open e-mails with malicious links and attachments.

That suggests that the botnet is being used by multiple groups with different objectives in mind, Cox said.

The data uncovered by NetWitness involved Kneber botnet activity between December 2009 and last month and shows that, in many cases, systems were compromised via a since-patched vulnerability affecting Adobe's PDF reader, Cox said.

Cox also noted that the Kneber botnet appears to have been designed to be more resilient to takedown attempts. More than half the machines infected with Kneber are also infected with a peer-to-peer bot called Waledac. While it is not unusual for compromised systems to have multiple strains of malware, in this case the Kneber bot appears to be actively logging Waledac activity and actually downloading Waledac to machines it has infected, Cox said.

"Either the Zeus guys are the same guys that are running Waledac, or there is some inter-gang cooperation going on," he said.

The effort to have two different bots, each with its own command-and-control infrastructure, running on one system is significant, Cox said. "If I take down the command-and-control structure of Zeus, Waledac is still running so I can use it to push Zeus back" onto infected systems, he said. "At the very least, two separate botnet families with different [command-and-control] structures can provide fault tolerance and recoverability in the event that one mechanism is taken down by security efforts," Cox said in a report detailing the Kneber botnet.

An analysis of IP addresses, domains and registration information shows that the servers being used to serve up Kneber-related malware are globally dispersed, Cox said. While many of the servers appear to be based in China, some are located in the Ukraine, Korea, Panama and the U.S.

Meanwhile, the registration information for the domain from which NetWitness recovered the stolen data cache includes an e-mail address that is associated with money-mule recruitment activity. The registrant contact is listed as having a street address in Virginia.

Money mules are people who are used (often without their knowledge) by cybercriminals to accept and launder stolen money.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.

Read more about Security in Computerworld's Security Topic Center.