ZeroAccess bot-herders abandon click-fraud network

  • Tim Greene (Network World)
  • — 19 December, 2013 21:57

Microsoft is claiming a total victory at least for this round over the ZeroAccess bot-herders whose criminal network was the target of a joint effort among Microsoft, the FBI, Europol and a group of security vendors.

"I am pleased to report that our disruption effort has been successful, and it appears that the criminals have abandoned their botnet," writes Richard Boscovich, assistant general counsel of Microsoft's Digital Crimes Unit, in the Official Microsoft  Blog.

+ Also on Network World: 'ZeroAccess' click-fraud botnet disrupted, but not dead yet | Microsoft: No Ballmer replacement until next year +

Bot-herders literally signaled their abandonment with a white flag. Part of a message sent to infected computers was "WHITEFLAG",  "which we believe symbolizes that the criminals have decided to surrender control of the botnet," Boscovich writes. "Since that time, we have not seen any additional attempts by the bot-herders to release new code and as a result, the botnet is currently no longer being used to commit fraud."

The company has also dropped its civil suit against the criminals (listed as John Does in court papers) in order to give law enforcement officials free rein to pursue them, Boscovich writes.

Getting the bot-herders to walk away from their network wasn't part of the plan two weeks ago when the takedown was executed through a court order that allowed Microsoft to take control of domain names linked to the botnet and to block command and control traffic to infected computers. Similar actions were taken by Europol in five European countries.

At the time of the takedown, Microsoft said, "Microsoft and its partners do not expect to fully eliminate the ZeroAccess botnet due to the complexity of the threat. However, Microsoft expects that this action will significantly disrupt the botnet's operation."

Boscovich says that within 24 hours of the disruption, the bot-herders pushed new instructions to infected computers so they could continue their illegal work, but those messages were  traced to their source IP addresses, which were then shut down. The final messages sent to the zombie machines included the word WHITEFLAG, he says.

Microsoft says ZeroAccess, also known as Sirefef, disables security software that might be running on victim computers, making it difficult to get rid of. Microsoft offers help here.

Tim Greene covers Microsoft and unified communications for Network World and writes the Mostly Microsoft blog. Reach him at tgreene@nww.com and follow him on Twitter@Tim_Greene.

Read more about wide area network in Network World's Wide Area Network section.

Tags: Europol, Microsoft, security, endpoint security, Wide Area Network, anti-malware, fbi

Lower costs help NZ pip Australia for F5 Networks support centre

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Trend Micro Data Loss Prevention

Comprehensive Data Loss Prevention Lowers Cost and Complexity

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.