Law enforcement agencies disrupt Gameover Zeus botnet

Two U.S. courts unseal charges releated to the giant botnet and the Cryptolocker ransomware

The U.S. Department of Justice, working with law enforcement agencies in other countries, revealed Monday a multinational effort to disrupt Gameover Zeus, a 2-year-old botnet employing an estimated 500,000 to 1 million compromised computers.

Two U.S. courts, meanwhile, have unsealed criminal charges against the alleged administrator of the giant Gameover Zeus botnet. The FBI estimates that Gameover Zeus, which targets banking credentials and other personal information, is responsible for more than US$100 million in losses.

In a separate but related action, U.S. and foreign law enforcement officials worked together to seize computer servers central to the malware known as Cryptolocker, a form of ransomware that encrypts files on victims' computers until they pay a ransom, the DOJ said.

"This operation disrupted a global botnet that had stolen millions from businesses and consumers as well as a complex ransomware scheme that secretly encrypted hard drives and then demanded payments for giving users access to their own files and data," Deputy Attorney General James Cole said in a statement.

In the Gameover Zeus case, a grand jury in Pittsburgh has unsealed a 14-count indictment against Evgeniy Mikhailovich Bogachev, 30, of Anapa, Russia, the DOJ announced Monday. The grand jury charged him with conspiracy, computer hacking, wire fraud, bank fraud and money laundering in connection with his alleged role as an administrator of Gameover Zeus.

Bogachev was also charged by criminal complaint in Omaha, Nebraska, with conspiracy to commit bank fraud related to his alleged involvement in the operation of a prior variant of Zeus malware known as Jabber Zeus.

"Gameover Zeus is the most sophisticated botnet the FBI and our allies have ever attempted to disrupt," FBI Executive Assistant Director Robert Anderson Jr. said in a statement. "The efforts announced today are a direct result of the effective relationships we have with our partners in the private sector, international law enforcement, and within the U.S. government."

In a separate civil injunction application filed in Pittsburgh, Bogachev is identified as the alleged leader of a tightly knit gang of cybercriminals based in Russia and Ukraine responsible for the development and operation of both the Gameover Zeus and Cryptolocker schemes.

A law enforcement investigation identified the Gameover Zeus network as a common distribution mechanism for Cryptolocker, the DOJ said.

Unsolicited emails containing an infected file purporting to be a voicemail or shipping confirmation are also widely used to distribute Cryptolocker. When opened, those attachments infect victims' computers. Bogachev is alleged in the civil filing to be an administrator of both Gameover Zeus and Cryptolocker.

Law enforcement agencies from several countries also participated in efforts to disrupt Gameover Zeus and Cryptolocker.

The U.S. Department of Homeland Security's Computer Emergency Readiness Team (US-CERT) has published a website to help victims of Gameover Zeus remove the malware.

In addition to the criminal charges announced Monday, U.S. law enforcement agencies have obtained civil and criminal court orders in Pittsburgh authorizing them to redirect the automated requests by victim computers away from the criminal operators to substitute servers established by investigators.

The order authorizes the FBI to obtain the Internet Protocol addresses of the victim computers reaching out to the substitute servers and to share that information with US-CERT, other countries' computer security agencies and private companies in an effort to assist victims of Gameover Zeus, the DOJ said. The FBI and other law enforcement agencies have not accessed the content of victims' computers or their electronic communications, the DOJ said.

Participating in the disruption operation were law enforcement agencies from Australia, the Netherlands, Germany, France, Italy, Japan, Canada, the Ukraine, the U.K. and other countries, the DOJ said.

In addition to the disruption operation against Gameover Zeus, the DOJ led a separate multi-national action to disrupt Cryptolocker, which began appearing about September 2013. The malware forces victims to pay as much as $700 to receive the keys necessary to unlock their files, the DOJ said.

By April, Cryptolocker had infected more than 234,000 computers, with approximately half of those in the U.S., the DOJ said. Victims made more than $27 million in ransom payments in the first two months after Cryptolocker emerged, according to one estimate.

Anyone claiming an interest in any of the property seized or actions enjoined pursuant to the court orders should visit the DOJ's Gameover Zeus website for notice of the full contents of the orders.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's email address is

Join the CSO newsletter!

Error: Please check your email address.

Tags U.S. Department of JusticesecurityU.S. Department of Homeland SecurityEvgeniy Mikhailovich BogachevlegalJames ColeIdentity fraud / theftfbicybercrimeRobert Anderson Jr.

More about CERT AustraliaDepartment of JusticeDOJFBIIDG

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Grant Gross

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts