Forest Global Training Partners

Cyber Risks · Krebs on Security

Microsoft Hunting Rustock Controllers

Summary: Microsoft disabled the Rustock botnet by obtaining an ex parte temporary restraining order to seize dozens of control servers hosted across U.S. providers, and about one-third of those servers were rented through an Eastern European reseller to a single customer who owed $1,600 in unpaid rent. The reseller traced payment to WebMoney purse Z166284889296, an attested account a former law enforcement officer tied to the name Vladimir Shergin, and the same purse was linked to SpamIt promoters Cosma2k, Bird and Adv1, whose combined commissions across SpamIt and Rx-Promotion reached nearly $2.14 million and about $200,000 respectively.

What you should know: The control servers drew just two abuse complaints from hosting ISPs because they only pushed updates and spam instructions to infected machines, so the infrastructure that ran the world's largest spam engine looked quiet to the providers renting it out. Microsoft must now make a good faith effort to notify the defendants through noticeofpleadings.com and possibly Russian newspapers of a Seattle court hearing, which puts the question of whether anyone answers in front of a security leader directly.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related