Bredolab Botnet Busted

Strategic Security Survey: Global Threat, Local Pain

The Bredolab botnet has been busted. So said the High Tech Crime Team, part of the National Crime Squad in the Netherlands, on Monday.

According to Dutch authorities, "the botnet network used servers hired in the Netherlands from a reseller of LeaseWeb," one of Europe's largest hosting providers, which is working with investigators. All told, 143 servers were seized and disconnected.

Subsequently, on Tuesday, a 27-year old Armenian was arrested at Armenia's Yerevan Airport at the request of the Dutch prosecutors, according to news reports. Dutch prosecutors allege that he's the mastermind behind the botnet.

The Bredolab botnet was responsible for infecting at least 30 million computers worldwide and spewing massive quantities of malware every day. According to Dutch authorities, "at the end of 2009 it was estimated that 3.6 billion emails with Bredolab virus payloads were sent daily to unsuspecting computer users."

Dutch authorities estimate that the Bredolab botnet, which they discovered late this past summer, could infect about 100,000 new computers per day. Once installed, Bredolab could monitor keystrokes, alter or copy files and steal personal financial information.

"The main intent of Bredolab is to download other malware onto the users' computers. Some of the attacks we have seen distributed this way include fake anti-virus software, also known as scareware," said Graham Cluley, senior technology consultant at Sophos. "Typically, the attacks were spammed out via old-fashioned, but still worryingly successful, spam campaigns as malicious attachments. In other words, no zero day-exploits, no sophisticated new techniques, just effective social engineering to make people run the attachments in the first place."

Users with Bredolab-infected computers will now be redirected to a help page created by Dutch authorities, offering virus-eradication advice.

The takedown of Bredolab follows the recent Zeus cybercrime sting, involving law enforcement agencies in the United States, United Kingdom, the Netherlands, as well as Ukraine.

That followed the arrest in July of a Slovenian citizen who the FBI -- in an investigation that also involved Spanish authorities -- charged with being the brains behind the Mariposa botnet.