Who’s Behind the TDSS Botnet?
Summary: A Krebs on Security investigation traced the awmproxy.net storefront, which rents access to computers infected with the TDSS botnet, to a Russian individual through a shared Google Analytics code, UA-3816538, and the email address fizot@mail.ru. WHOIS records tied that address to domains registered under the name Galdziev Chingiz in St. Petersburg, and a purchase confirmation email from the payment processor Plimus listed xtexcounter@bk.ru as AwmProxy's support contact.
Key Takeaway: The TDSS botnet's rental storefront took Visa and MasterCard payments through Plimus, which processed the orders and collected the money, so a mainstream payment processor sat between criminal botnet access and the card networks. The operator deleted nearly all of his LiveJournal posts and YouTube videos once the story ran, and claimed he had sold the service long ago without naming a buyer.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026