Những người tham gia hoạt động đã kể về cách Microsoft loại bỏ cơ sở hạ tầng của mạng botnet ZLoader

Tuần trước, Microsoft, ESET, Phòng thí nghiệm hoa sen đen, Mạng Palo Alto, Health-ISAC and Financial Services-ISAC took control of the infamous ZLoader botnet following an injunction issued by the U.S. Court for the Northern District of Georgia.

In the end, the company seized control of 65 hard-coded domains that ZLoader operators use to control the botnet, as well as 319 more DGA-registered domains that the hackers used to create redundant communication channels.

The ZLoader botnet consists of computing devices in businesses, hospitals, schools and homes around the world and is operated by an international criminal group that offers malware as a service (MaaS) designed to steal and extort money. During the investigation, we found that one of the perpetrators of creating a component used in the ZLoader botnet to distribute ransomware is Denis Malikov, who lives in the city of Simferopol on the Crimean peninsula. We decided to name the person linked with this case to make it clear that cybercriminals are not allowed to hide behind online anonymity to commit their crimes.experts say.

Let me remind you that around the same time, another Botnet Fodcha Attacks More Than 100 nạn nhân hàng ngày.

Zloader (aka Terdot hoặc DELoader) is a well-known banking Trojan that was first discovered back in August 2015 during attacks on clients of several British financial companies. Its capabilities include capturing screenshots, harvesting cookies, stealing credentials and banking information, conducting reconnaissance on the device, triggeringpinningmechanisms on the device, providing remote access to attackers, và như thế. The malware is almost entirely based on the source code of the Zeus trojan, which leaked over a decade ago.

At first, the malware was actively used to attack banks around the world, from Australia and Brazil to North America, and its ultimate goal was to collect financial data using web injections and social engineering in order to trick infected bank customers into giving up their authentication codes and credentials.

But in recent years, Zloader has evolved to include many other features, such as being able to act as a backdoor and give hackers remote access to an infected system, and it can also be used as a malware loader and to install additional payloads.

Microsoft và mạng botnet ZLoader
ZLoader Attack Scheme

Tuy nhiên, cybercriminality does not stopwe recently reported that Cyclops Blink botnet attacks Asus routers.

Errol Weiss
Errol Weiss

Health-ISAC’s Chief Security Officer Errol Weiss said that legal solutions, such as the one that led to the fall of the ZLoader infrastructure, are being prepared in large-scale cooperation with a wide variety of organizations, including those affected by attacks by cybercriminals. Ví dụ, such as Health-ISAC.

Weiss told SC Media that, Trên thực tế, Microsoft has gone to court to grant them ownership of the infrastructure used by the bot.

They created a legal and technical strategy, combined, to use civil lawsuits filed against criminal gangs, botnet operators. They’d use the civil lawsuits, racketeering laws, and copyright law to show that those botnets were causing immediate harm to their customers. You can imagine all of the politics and socialization that had to happen in the background to make this happen.Errol Weiss said.

Helga Smith

Tôi luôn quan tâm đến khoa học máy tính, đặc biệt là bảo mật dữ liệu và chủ đề, được gọi là ngày nay "khoa học dữ liệu", kể từ khi tôi còn ở tuổi thiếu niên. Trước khi vào nhóm Diệt Virus với vai trò Tổng biên tập, Tôi đã làm việc với tư cách là chuyên gia an ninh mạng tại một số công ty, bao gồm một trong những nhà thầu của Amazon. Một trải nghiệm khác: Tôi đã nhận được đang giảng dạy tại các trường đại học Arden và Reading.

Gửi phản hồi

Website này sử dụng Akismet để hạn chế spam. Tìm hiểu bình luận của bạn được duyệt như thế nào.

Nút quay lại đầu trang