After weeklong fight, rogue ISP Troyak struggles for life
IDG News Service - After an international take-down effort, a rogue ISP responsible for controlling large numbers of computers infected with data-stealing code is down for the moment, but it may be reconnecting with the Internet, according to security researchers.
Troyak, which is believed to be based in eastern Europe, was knocked offline earlier this month after other networks supplying its connectivity to the Internet stopped carrying its traffic due to complaints it was complicit in cybercrime.
Since then the network has fought a cat-and-mouse game with network providers in 12 countries and international law enforcement, according to Jart Armin, the pseudonymous editor of the Hostexploit.com Web site, which has been involved in the action.
"Troyak is still fighting hard, as it is the only link to the outside Internet for a few [criminal groups]," he said in an e-mail interview.
Troyak and another ISP, Group 3, provided connectivity for 90 of 249 servers used to control Zeus, a sophisticated piece of malware that steals financial credentials and other data. Group 3 has also been disconnected.
At this point, Troyak's reputation is so sullied that it is becoming difficult for it to find other ISPs to carry its traffic on the Internet.
That's an important point, because for Troyak to resume operations, it must find another company or organization that it can peer with in order to be reconnected to the Internet. Currently, even with Troyak offline, there are still 180 Zeus command-and control servers online, Armin said. Most of these are located in Russia and Ukraine, however, making it easier for security researchers and law enforcement to stay on top of the problem.
"They're being pushed back into their own territory," Armin said.
On Sunday night, Troyak operators apparently hacked into servers in Latvia to get connectivity via an academic network in the country. But that effort was shut down with the help of Latvian law enforcement, Armin said.
But that action appeared to be temporary, and as of Wednesday, Troyak was dead.
"Troyak seems to be down," said an administrator for Zeus Tracker. "And I believe that it won't come up again. Every ISP knows that Troyak is bad and won't peer/route their badness."
But there are signs its operators are making efforts to be reconnected. Computer security experts such as Joze Nazario of Arbor Networks are watching real-time routing tables, which show how Internet traffic is exchanged between ISPs and networks.
An entity called SAINTVPN is now carrying some of the traffic that used to be on Troyak, Nazario said.
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- Preparing Your Infrastructure for the Hyperconvergence Era From cloud computing and virtualization to mobility and unified communications, an array of innovative technologies is transforming today's data centers.
- Increase IT Performance from the Enterprise to the Cloud with WAN Optimization Massive consolidation and data mobility, enabled by virtualization, have radically altered how we build servers, design applications, and deploy storage for the emerging...
- Live Webcast
Transforming Finance, Procurement and Supply Chain Effectiveness with Cross-Functional Analytics
Date: May 6th, 2014
Time: 1 PM EDT
Attend this Webcast to find out how Oracle's packaged analytic applications enable line-of-business managers to examine all...
- Video Stream Quality Impacts Viewer Behavior This scientific white paper, using statistical data from Amakai's streaming network, analyzes how changes in video quality cause changes in viewer behavior.
- Service-Enabling CICS Applications: Best Practices This informative webcast provides an informed, thorough look into CICS service-enablement options and how they can affect your environment. You'll learn how to... All Applications White Papers | Webcasts