Attacks/Breaches
10/26/2010
07:33 PM
Connect Directly
RSS
E-Mail
50%
50%

Bredolab Botnet Busted

The Dutch High Tech Crime Team has seized 143 servers used to infect an estimated 30 million computers and arrested the alleged mastermind behind the botnet.

Strategic Security Survey: Global Threat, Local Pain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
The Bredolab botnet has been busted. So said the High Tech Crime Team, part of the National Crime Squad in the Netherlands, on Monday.

According to Dutch authorities, "the botnet network used servers hired in the Netherlands from a reseller of LeaseWeb," one of Europe's largest hosting providers, which is working with investigators. All told, 143 servers were seized and disconnected.

Subsequently, on Tuesday, a 27-year old Armenian was arrested at Armenia's Yerevan Airport at the request of the Dutch prosecutors, according to news reports. Dutch prosecutors allege that he's the mastermind behind the botnet.

The Bredolab botnet was responsible for infecting at least 30 million computers worldwide and spewing massive quantities of malware every day. According to Dutch authorities, "at the end of 2009 it was estimated that 3.6 billion emails with Bredolab virus payloads were sent daily to unsuspecting computer users."

Dutch authorities estimate that the Bredolab botnet, which they discovered late this past summer, could infect about 100,000 new computers per day. Once installed, Bredolab could monitor keystrokes, alter or copy files and steal personal financial information.

"The main intent of Bredolab is to download other malware onto the users' computers. Some of the attacks we have seen distributed this way include fake anti-virus software, also known as scareware," said Graham Cluley, senior technology consultant at Sophos. "Typically, the attacks were spammed out via old-fashioned, but still worryingly successful, spam campaigns as malicious attachments. In other words, no zero day-exploits, no sophisticated new techniques, just effective social engineering to make people run the attachments in the first place."

Users with Bredolab-infected computers will now be redirected to a help page created by Dutch authorities, offering virus-eradication advice.

The takedown of Bredolab follows the recent Zeus cybercrime sting, involving law enforcement agencies in the United States, United Kingdom, the Netherlands, as well as Ukraine.

That followed the arrest in July of a Slovenian citizen who the FBI -- in an investigation that also involved Spanish authorities -- charged with being the brains behind the Mariposa botnet.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5700
Published: 2014-09-22
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/index.php or the (2) username or (3) password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some o...

CVE-2014-0484
Published: 2014-09-22
The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."

CVE-2014-2942
Published: 2014-09-22
Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code.

CVE-2014-3595
Published: 2014-09-22
Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.

CVE-2014-3635
Published: 2014-09-22
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows remote attackers to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one m...

Best of the Web
Dark Reading Radio