Botnet Zeus merely slowed by amputation
One of the most notorious networks of infected computers suffered a painful but short-lived loss this week after a rogue Internet service provider was cut off from the Web. As many as a third of the “command and control” machines in the Zeus botnet were effectively disabled by the move, though it doesn’t appear that’s a permanent effect.
Zeus is technically the name of a Trojan horse virus, though it’s also come to refer to the network of infected computers around the world which have fallen victim to it. Estimates vary, but the number of machines involved is certainly well into the millions. There are few if any countries which don’t house at least one Zeus-infected computer.
A Web site set up to monitor Zeus reports that while there are normally 249 servers which control the network, this dropped on Tuesday to 181. Security firm ScanSafe confirmed these reports and noted a proportional drop in malware attacks across the net.
The incident has been traced to two network providers in the Ukraine and Russia cutting all access to “downstream” customers: in other words, ISPs who then sell access to the public. These ISPs included AS Troyak, fingered as one of the main providers for the Zeus servers.
It’s not yet known what prompted the network providers to cut the access; it’s a drastic measure as it will also have cut off access to legitimate customers, which isn’t exactly good for a firm’s public relations.
Unfortunately, as is often the case with such incidents, the disconnected Zeus servers appear to largely be back in action today, apparently through different ISPs. The quick recovery may explain a sudden boost in traffic to the relevant servers shortly before AS Troyak was cut off: it appears the people behind the Zeus botnet may have somehow got advanced warning and that the extra traffic was the result of them sending instructions for reconnecting elsewhere after the takedown.
Related Posts:
