Multinational operation busts Windows botnet that infected half a million PCs

The FBI, UK’s National Crime Agency and Europol hope to squash the insidious Gameover Zeus botnet to bits under a joint project called Operation Tovar. According to US Deputy Attorney General Cole, the three agencies (with help from various security firms) have successfully disabled not only the botnet itself, but also associated malware Cryptolocker. Authorities have apparently taken control of the Gameover bots and seized its command servers over the weekend, effectively freeing 300,000 of the 500,000 to 1 million infected Windows computers. Even better, they’ve found the crime ring behind the botnet and have charged alleged Russian mastermind Evgeniy Mikhailovich Bogachev with hacking, different types of fraud, money laundering and conspiracy.

Gameover Zeus, for those who’ve never heard of it in the past, is a P2P malware that pilfers banking information and initiates wire transfers to overseas bank accounts. It’s typically propagated through spam emails disguised as bills or invoices embedded with malicious links — the kind you tell your grandparents to never click. Once Gameover worms its way into a system, that computer becomes part of the extortion ring’s global network of infected machines, which funnel ill-gotten info back to the criminals. The perpetrators would sometimes also install compromised PCs with Cryptolocker, a “ransomware” that takes users’ files hostage until they pay up. According to the FBI’s estimates, the criminals have stolen over $100 million using both Gameover and Cryptolocker. But whether that’s enough for Bogachev to stand trial in the US (home to 25 percent of the affected machines) remains to be seen, as Russia does not extradite accused criminals. For now, all the authorities can do is spread word about the botnet and help people remove it from their computers.

Comments

Via: Reuters

Source: The United States Department of Justice, US-CERT, FBI