Fox IT analysts demystify the Pobelka botnet
Analysts from Dutch-based security audit firm Fox-IT have recently released examined in great detail a botnet that has been around for quite some time, and is still functioning and bringing money to its master.
Fox-IT, a firm that rose to international prominence following the DigiNotar breach, has detailed in a report the identity of the people running the Pobelka botnet, and has described how it was started and how its still working.
The Pobelka botnet is just one of the many botnets currently operating in the Netherlands.
Its botmaster is targeting mostly Dutch and German users (but occasionally also those from Sweden, the U.S. and the United Arab Emirates), and is harvesting a wide array of information from their computers by infecting them with the Citadel banking and information-stealing Trojan.
Initially, the botmasters’ Trojan of choice was SpyEye, but he (she?) added Citadel to it around February 2012. He also started his attacks with a server-based attack kit the researchers dubbed as “Bentpanel”, then switched to using the Blackhole exploit kit to deliver the malware.
While analyzing Bentpanel’s backend, they concluded that the botmaster uses the online name of “Finist”. The panel also contained the botmasters jabber address where he received notifications from the panel.
The researchers believe that Finist sells the stolen information to the highest bidder, and occasionally uses stolen banking information to steal money. At one time, Finist even employed money mules to get to the money he transferred to accounts set up specifically for this purpose.
“The Pobelka botnet is just one of the many examples of how a single individual was able to attack Internet users for over a year without much resistance,” the analysts noted. “The ease at which cybercrime services are available to criminals, makes it trivial for anyone to start in this business. The potential gains for the criminals are large, with little to no chance of successful prosecution.”
For in-depth details about the Pobelka botnet, I suggest reading the extremely interesting Fox-IT report.