ZeroAccess bot-herders abandon click-fraud network

Microsoft is claiming a total victory at least for this round over the ZeroAccess bot-herders whose criminal network was the target of a joint effort among Microsoft, the FBI, Europol and a group of security vendors.

"I am pleased to report that our disruption effort has been successful, and it appears that the criminals have abandoned their botnet," writes Richard Boscovich, assistant general counsel of Microsoft's Digital Crimes Unit, in the Official Microsoft  Blog.

+ Also on Network World: 'ZeroAccess' click-fraud botnet disrupted, but not dead yet | Microsoft: No Ballmer replacement until next year +

Bot-herders literally signaled their abandonment with a white flag. Part of a message sent to infected computers was "WHITEFLAG",  "which we believe symbolizes that the criminals have decided to surrender control of the botnet," Boscovich writes. "Since that time, we have not seen any additional attempts by the bot-herders to release new code and as a result, the botnet is currently no longer being used to commit fraud."

The company has also dropped its civil suit against the criminals (listed as John Does in court papers) in order to give law enforcement officials free rein to pursue them, Boscovich writes.

Getting the bot-herders to walk away from their network wasn't part of the plan two weeks ago when the takedown was executed through a court order that allowed Microsoft to take control of domain names linked to the botnet and to block command and control traffic to infected computers. Similar actions were taken by Europol in five European countries.

At the time of the takedown, Microsoft said, "Microsoft and its partners do not expect to fully eliminate the ZeroAccess botnet due to the complexity of the threat. However, Microsoft expects that this action will significantly disrupt the botnet's operation."

Boscovich says that within 24 hours of the disruption, the bot-herders pushed new instructions to infected computers so they could continue their illegal work, but those messages were  traced to their source IP addresses, which were then shut down. The final messages sent to the zombie machines included the word WHITEFLAG, he says.

Microsoft says ZeroAccess, also known as Sirefef, disables security software that might be running on victim computers, making it difficult to get rid of. Microsoft offers help here.

Tim Greene covers Microsoft and unified communications for Network World and writes the Mostly Microsoft blog. Reach him at tgreene@nww.com and follow him on Twitter@Tim_Greene.

Read more about wide area network in Network World's Wide Area Network section.

Tags EuropolMicrosoftsecurityendpoint securityWide Area Networkanti-malwarefbi

Comments

Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

SECURE Web Gateway

Balancing the requirement for strong network security with the need to harness collaborative web technologies is essential for business growth.

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.