Forest Global Training Partners

Cyber Risks · Krebs on Security

Backstage with the Gameover Botnet Hijackers

Summary: Two unnamed security experts described to Krebs on Security how a global collaborative effort last week hijacked the Gameover Zeus peer-to-peer botnet, which had helped an elite group of thieves steal more than $100 million from banks, businesses and consumers worldwide. The operation had to seize the botnet's proxy node and P2P layers and also neutralize its fallback domain generation algorithm, which produces a list of 1,000 domains each week across six top-level domains including .ru.

Bottom line: The takeover team had studied the botnet for two and a half years, and the operators' roughly 1,500 custom Web injects targeted more than 700 financial institution sites worldwide while conspicuously excluding banks in Russia and former Soviet satellite countries. New Gameover Zeus infections have dropped to zero, but the same crew's Cutwail spam infrastructure had been reinfecting machines continuously, and the experts say past takedowns only taught the operators to harden their code.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related