07:33 PM

Bredolab Botnet Busted

The Dutch High Tech Crime Team has seized 143 servers used to infect an estimated 30 million computers and arrested the alleged mastermind behind the botnet.

Strategic Security Survey: Global Threat, Local Pain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
The Bredolab botnet has been busted. So said the High Tech Crime Team, part of the National Crime Squad in the Netherlands, on Monday.

According to Dutch authorities, "the botnet network used servers hired in the Netherlands from a reseller of LeaseWeb," one of Europe's largest hosting providers, which is working with investigators. All told, 143 servers were seized and disconnected.

Subsequently, on Tuesday, a 27-year old Armenian was arrested at Armenia's Yerevan Airport at the request of the Dutch prosecutors, according to news reports. Dutch prosecutors allege that he's the mastermind behind the botnet.

The Bredolab botnet was responsible for infecting at least 30 million computers worldwide and spewing massive quantities of malware every day. According to Dutch authorities, "at the end of 2009 it was estimated that 3.6 billion emails with Bredolab virus payloads were sent daily to unsuspecting computer users."

Dutch authorities estimate that the Bredolab botnet, which they discovered late this past summer, could infect about 100,000 new computers per day. Once installed, Bredolab could monitor keystrokes, alter or copy files and steal personal financial information.

"The main intent of Bredolab is to download other malware onto the users' computers. Some of the attacks we have seen distributed this way include fake anti-virus software, also known as scareware," said Graham Cluley, senior technology consultant at Sophos. "Typically, the attacks were spammed out via old-fashioned, but still worryingly successful, spam campaigns as malicious attachments. In other words, no zero day-exploits, no sophisticated new techniques, just effective social engineering to make people run the attachments in the first place."

Users with Bredolab-infected computers will now be redirected to a help page created by Dutch authorities, offering virus-eradication advice.

The takedown of Bredolab follows the recent Zeus cybercrime sting, involving law enforcement agencies in the United States, United Kingdom, the Netherlands, as well as Ukraine.

That followed the arrest in July of a Slovenian citizen who the FBI -- in an investigation that also involved Spanish authorities -- charged with being the brains behind the Mariposa botnet.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-01-31
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 does not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certifica...

Published: 2015-01-31
The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.

Published: 2015-01-31
Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.

Published: 2015-01-31
Multiple cross-site scripting (XSS) vulnerabilities in the note-creation page in QPR Portal 2014.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body field.

Published: 2015-01-31
Cross-site scripting (XSS) vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.