Zeus botnet dealt a blow as ISP Troyak knocked out
IDG News Service - Internet service providers linked to the notorious Zeus botnet have been taken down, knocking out a third of the command-and-control servers that run the network of hacked machines.
Two ISPs, named Troyak and Group 3, were home to 90 of the 249 known Zeus command-and-control servers. Zeus Tracker, a Web site that tracks the botnet, noticed the steep drop in servers on Wednesday morning.
The Troyak network was itself an upstream provider to six networks, known to host a large number of cybercrime servers, including Web sites used in drive-by attacks and phishing sites, according to Kevin Stevens, a researcher with SecureWorks. "There's lots of Zeus and Fragus exploit kit [sites]," he said. Whoever was behind the takedown "just decided to knock out a large area of cybercirme, and this was probably one of the easiest ways to do it."
Troyak is based in Kostanay, Kazakhstan, according to whois records. The company could not be reached immediately for comment.
The Zeus Tracker administrator, who asked not to be named, said that at first he thought that there had been some type of technical error in the Zeus code. On further investigation, he discovered that Troyak had been taken offline, which in turn knocked the networks hosting the botnet servers off the Internet.
This kind of ISP takedown has worked in the past. Just over a year ago, McColo, in San Jose, California, was taken offline by its upstream service providers, resulting in a temporary, but dramatic, drop in spam as its botnet command-and-control servers on its network were disabled.
As with the McColo takedown, Troyak's upstream providers seem to have knocked it off the Internet, Cisco said in a statement. "The ISP was 'De-peered,'" Cisco said. "Troyak's upstream network providers effectively pulled the plug on Troyak's router, refusing to transmit its traffic."
Zeus is actually a botnet-making kit that allows cybercriminals to create their own networks of infected computers, but it has been associated with a wave of financial fraud that has caused hundreds of millions in losses to U.S. financial institutions over the past year. Organized crime groups in Eastern Europe are thought to be behind this fraud.
Wednesday's takedown appears to have targeted one of the Zeus gangs, but it is remarkable in that whomever is responsible for the effort is asking not to be identified.
A security researcher who uses the pseudonym Jart Armin attributed Troyak and Group 3's disconnection to "good community action" and said that there was "more being done right now involving many, to ensure the [Zeus gang] have nowhere to go."
"Not every action is a corporate PR exercise," he said. "And we cannot get these guys by knocking off a bunch of domains via a court in Virginia," a reference to Microsoft's recent court-ordered takedown of the Waledac botnet.
- 18 Hot IT Certifications for 2014
- CIOs Opting for IT Contractors Over Hiring Full-Time Staff
- 12 Best Free iOS 7 Holiday Shopping Apps
- For CMOs Big Data Can Lead to Big Profits
- Slideshow: 5 ways to lock down your mobile device
- Slideshow: 10 mistakes companies make after a data breach
- How to rob a bank: A social engineering walk through
- Which smartphone is the most secure?
If you like your iPhone, you can keep your iPhone. Period.
President Obama has revealed that he's not permitted to carry an iPhone. It's too insecure for the job, he says. Instead, he's stuck with a BlackBerry. Well, someone's got to have one still. However, it turns out that the Pentagon has also outlawed non-BlackBerry smartphones. In IT Blogwatch, bloggers joke that 2006 called and they want their smartphones back.
- IT Certification Study Tips
- Register for this Computerworld Insider Study Tip guide and gain access to hundreds of premium content articles, cheat sheets, product reviews and more.
- Mitigating DDoS Attacks with F5 Technology
- This document examines various DDoS attack methods and the application of specific ADC technologies to block attacks in the DDoS threat spectrum while...
- The DDoS Threat Spectrum
- Bolstered by favorable economics, today's global botnets are using distributed denial-of-service (DDoS) attacks to target firewalls, web services, and applications, often simultaneously.
- Defending Against Denial of Service Attacks
- By utilizing end-user interviews, this whitepaper explores a deeper understanding of DDoS defense plans and reveals the knowledge gaps around the Denial of...
- Strategic Solutions for Government IT
- This paper outlines why F5 is the optimum partner to help achieve the levels of security, performance and availability that are vital to...
- BYOD Invasion: A Computerworld Report on the Consumerization of IT
- We profile three companies that aren't just coping, but learning valuable lessons. If, like them, you're thinking about mobile device management our definitive... All Government IT White Papers
- Video: 5 Secrets To Scaling Enterprise Apps Watch this video to learn how to successfully scale enterprise apps>>
- Collaboration 2013: Where Mobility Meets Connectivity Mobility and collaboration are quickly converging and users are demanding more capabilities. It's no longer enough to enable file sharing. This Webcast dives...
- Modernizing SAP environments with minimum risk - a path to Big Data Hear from top IDC analyst, Richard Villars, about the path you can start taking now to enable your organization to get the benefits...
- The Power of the Citrix Mobility Solution, XenMobile Does everything become a smartphone? Or does the smartphone begin to do everything? How can we afford to support BYOD? Rather, how can...
- BYOD Happens: How to Secure Mobility How to navigate the journey of securing mobility, including the BYOD corruption of IT, the top ten mobility strategies, and the mobility management...
- All Government IT Webcasts
Does your organization offer extensive benefits, cool perks, competitive salaries, opportunities for training and advancement? Then get it recognized!
Nominate your company or another deserving organization for Computerworld's 2014 Best Places to Work in IT list now through Dec. 12, 2013.