Fox IT analysts demystify the Pobelka botnet
Posted on 18 January 2013.
Analysts from Dutch-based security audit firm Fox-IT have recently released examined in great detail a botnet that has been around for quite some time, and is still functioning and bringing money to its master.

Fox-IT, a firm that rose to international prominence following the DigiNotar breach, has detailed in a report the identity of the people running the Pobelka botnet, and has described how it was started and how its still working.

The Pobelka botnet is just one of the many botnets currently operating in the Netherlands.

Its botmaster is targeting mostly Dutch and German users (but occasionally also those from Sweden, the U.S. and the United Arab Emirates), and is harvesting a wide array of information from their computers by infecting them with the Citadel banking and information-stealing Trojan.

Initially, the botmasters' Trojan of choice was SpyEye, but he (she?) added Citadel to it around February 2012. He also started his attacks with a server-based attack kit the researchers dubbed as "Bentpanel", then switched to using the Blackhole exploit kit to deliver the malware.

While analyzing Bentpanel's backend, they concluded that the botmaster uses the online name of "Finist". The panel also contained the botmasters jabber address where he received notifications from the panel.

The researchers believe that Finist sells the stolen information to the highest bidder, and occasionally uses stolen banking information to steal money. At one time, Finist even employed money mules to get to the money he transferred to accounts set up specifically for this purpose.

"The Pobelka botnet is just one of the many examples of how a single individual was able to attack Internet users for over a year without much resistance," the analysts noted. "The ease at which cybercrime services are available to criminals, makes it trivial for anyone to start in this business. The potential gains for the criminals are large, with little to no chance of successful prosecution."

For in-depth details about the Pobelka botnet, I suggest reading the extremely interesting Fox-IT report.


Critical bug found in Cisco ASA products, attackers are scanning for affected devices

Several Cisco ASA products - appliances, firewalls, switches, routers, and security modules - have been found sporting a flaw that can ultimately lead to remote code execution by attackers.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Feb 12th