FBI And Europol Disrupt Botnet Digital Bank Robbers

The FBI, the British National Crime Agency (NCA) and Europol are working to disrupt a botnet that criminals use to steal 30 million online bank accounts. It involves the Dridex-malware, where the US government yesterday for warned.

Through the malware managed to infect criminals in Moldova and other countries, computers and then steal data for Internet banking. In this way could then money from online accounts are stolen. One of the managers of the Dridex botnet has now sued. It is a 30 year old man from Moldova who in late August was arrested in Cyprus.

The various investigative agencies are now working for the malware to 'sink holes' so that the criminals behind the botnet can no longer control the infected computers. This involves a continuous campaign directed against different versions of Dridex and the criminals behind it, says Europol.

McAfee Receives Award For Research Into Botnet

Anti-virus company McAfee has at the Virus Bulletin conference in Prague received an award for research into a botnet which was in collaboration with the Dutch police shut. The botnet, which Beebone, VObfus or AAEH was called, was a polymorphic botnet.


The malware that caused computers part of the botnet had been active since 2009 and spread via infected USB sticks and social engineering. In early April of this year, the botnet was the High Tech Crime Team (THTC) of the Dutch police, the FBI, Europol and security Intel Security, Kaspersky Lab and Shadow Server taken off the air.

To disable the botnet domains were all registered and seized that used the malware to communicate with infected computers. Then the investigating authorities showed these areas to the servers of Internet providers and computer emergency response teams (CERTs) by pointing all over the world, a process also known as "sink holes" is mentioned.Research showed that the malware had infected 12 000 computers.

According to McAfee cooperation between law enforcement agencies and security companies was essential to make the botnet from the air. The anti-virus company wrote a technical report (pdf) on the malware and operation of the botnet.Previously received McAfee last week at the Virus Bulletin conference Peter Szor Award. An annual prize for the best security research named after the anti-virus pioneer deceased in 2013.

Szor began twenty years ago with the analysis of malware and in 2005 wrote the book "The Art of Computer Virus Research and Defense. He worked for Symantec and F-Secure, before he went to work in 2011 at McAfee. In 2013 died he unexpectedly. "This kind of research makes everyone safer, as did the survey conducted late Peter Szor," said Martijn Grooten of Virus Bulletin.

Illegal Software Hinders Cleaning Infected computers

Almost one million computers are still infected with the Confickerworm from 2008 mainly because of users of pirated software and ICT development in countries. Which enable researchers from the TU Delft , which their study next week at a conference presentation in Washington DC.

According to the researchers, the figures show that the removal of botnets slower than replacing Windows XP computers.Conficker was one of the largest botnets ever. The worm spread via a vulnerability in the Windows Server service which was patched in 2008 through an emergency patch from Microsoft. In addition, used the shared network folders and the Autorun feature. Six years ago, security companies and researchers knew the botnet to "sink holes", which infected computers do not connect to the servers of the cyber criminals behind the botnet.

Despite various measures to clean up infected computers, there are nearly one million computers infected with Conficker. It is in many cases illegal versions of Windows XP and Vista. According to the researchers enable users of pirated software, automatic updates, fearing updates which disables their illegal software, Microsoft has already said that it also provides illegal Windows versions of security updates.

To address the problems with clearing of botnets and cleaning up infected computers the researchers argue that in addition to helping countries with their ICT development, automatic updates and automatic cleanups are the main tools for the issue.Software developers should configure their software so that the installation of security updates is enabled by default and that all computers receive the updates, even if they are using a pirated version of the software.