Feeds

US and UK arrests in computer worm probe

THr34t-Krew taken down

  • alert
  • submit to reddit

The Essential Guide to IT Transformation

Two UK men were arrested this morning following police raids in the UK and US aimed at dismantling an international hacker group believed to have created a virulent computer worm.

Officers from the Durham Constabulary arrested a 19 year-old electrician and a 21 year-old unemployed man after seizing evidence related to computer and drugs offences during a raid on two addresses in County Durham this morning.

The pair are being interviewed today by officers of the UK's National Hi-Tech Crime Unit (NHTCU).

Police believe the two UK based men are members of an international hacking group calling themselves the "THr34t-Krew".

The group has created an Internet worm, called the TK worm, which infected approximately 18,000 computers around the world, according to a statement by the NHTCU.

Investigators estimate the worm caused disruption and damage to computer systems in the UK and overseas estimated at £5.5 million.

The operation against the THr34t-Krew group was jointly planned by officers from Durham Constabulary and the US multi-agency CATCH team (Computer and Technology Crime Hi-Tech Response Team).

The California-based CATCH team consists of representatives from the United States Secret Service, Department of Justice, and the FBI among others.

While UK police were searching homes in County Durham, a simultaneous search warrant was executed at an address in Illinois, USA, where additional evidence in the case was seized and one man arrested.

None of the arrests are connected to the recent SQL Slammer Worm, the NHTCU states.

What the heck is the TK worm?

Antivirus experts we contacted were not immediately familiar with the TK worm, so (for now) we need to rely on a police description of the malicious code which first came to the attention of the NCTCU in mid- January.

The worm known as the TK worm has been found to be present in a number of computers in the UK. The cost of the disruption is estimated at £5.5m.

Once connected to the Internet, the infected computer connects to a number of computers under the control of the THr34t-Krew, who are able to send commands to the infected hosts. These commands could range from scanning other computers for vulnerabilities, starting Distributed Denial of Service attacks on other computers and web sites. The TK worm is self-replicating and is able to spread itself across the Internet distributing itself to other computers.

A search on Google for THr34t-Krew reveals one user's experiences of dealing with this worm but not much else. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.