Microsoft names alleged Zeus bot herders
Posted on 03.07.2012
Bookmark and Share
When Microsoft disrupted two of the most harmful botnets using Zeus malware in March, they also filed a lawsuit at the federal district court in New York against the bot herders who, at the time, were unknown and defined only as "John Doe" defendants.

But Richard Boscovich, Senior Attorney with Microsoft Digital Crimes Unit, has yesterday revealed that they have amended the complaint and named two Ukrainian man as defendants: one Yevhen Kulibaba and one Yuriy Konovalenko.

The have also discovered that these men were currently serving jail time in the UK for other Zeus malware related charges, to which they pleaded guilty and were sentenced for last year.

"Microsoft has advised the UK government of the criminal referral to the FBI," shared Boscovich, meaning that once the two men serve their sentences, they will likely be extradited to the US for this trial.

"Our best efforts to identify the remaining John Doe defendants turned up no response," wrote Boscovich, and added that Microsoft will continue their efforts to serve Kulibaba and Konovalenko, and the John Doe defendants, with this amended complaint.

In the meantime, the C&C servers Microsoft managed to shut down are still down, and according to Boscovich, this disruption has led to a sizable reduction Zeus infection rates, and the discovery of the IP addresses of many machines infected with the malware, making it possible to coordinate an action that will help people regain control of their infected computers.

"As Iíve written previously, the goal of this operation was not to entirely take out all of the botnets running on Zeus-based malware. Microsoft and our financial industry partners sought to help protect innocent people by disrupting the Zeus business model and increasing the cost of doing business for cybercriminals," Boscovich pointed out.

"Iím happy to report that we are already seeing proof that our disruptive actions were successful in achieving this goal. We mitigated the threat and caused long-term damage to the cybercriminal organization that relies on these botnets for illicit gain."






Spotlight

Attackers use reflection techniques for larger DDoS attacks

Posted on 17 April 2014.  |  Instead of using a network of zombie computers, newer DDoS toolkits abuse Internet protocols that are available on open or vulnerable servers and devices. This approach can lead to the Internet becoming a ready-to-use botnet for malicious actors.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Apr 17th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //