Feeds

Chinese Nitol botnet host back up after Microsoft settles lawsuit

Owner agrees to chuck nasties down the sinkhole

5 things you didn’t know about cloud backup

Microsoft has reached a settlement with the Chinese site linked to the Nitol DDoS botnet.

The emerging Nitol botnet was hosted by the 3322.org domain. In order to stem the threat, Microsoft filed a suit to take control of the 70,000 malicious subdomains hosted on 3322.org, gaining control of the domain in mid September.

Redmond uncovered the scam during an investigation (PDF) into insecure supply chains. It seems that corrupt (but unnamed) computer resellers in China were planting malware on victims' machines as a means to make extra money from pay-per-install malware affiliate programs and similar scams.

The 3322.org played host to a multitude of backdoors, Trojans and other strains of malware as well as Nitol prior to the Redmond-initiated enforcement action.

The operator of 3322.org, Peng Yong, recently agreed to work in cooperation with Microsoft and the Chinese Computer Emergency Response Team (CN-CERT) to fight cybercrime. Based on this settlement agreement, Redmond allowed the 3322.org domain to resume operations, on condition that that any sub-domains linked to malware are placed on a "block-list" and redirected to a sink-hole managed by Microsoft. 3322.org also agreed to help identify computer users in China left infected by the earlier spread of the Nitol botnet and other malware strains tied to 3322.org.

"We’re very pleased by this outcome, which will help guarantee that the 70,000 malicious subdomains associated with 3322.org will never again be used for cybercrime," Richard Domingues Boscovich, assistant general counsel at Microsoft's Digital Crimes Unit, writes in a blog post announcing the settlement.

In the 16 days since we began collecting data on the 70,000 malicious subdomains, we have been able to block more than 609 million connections from over 7,650,000 unique IP addresses to those malicious 3322.org subdomains. In addition to blocking connections to the malicious domains, we have continued to provide DNS services for the unblocked 3322.org subdomains. For example, on Sept 25, we successfully processed 34,954,795 DNS requests for 3322.org subdomains that were not on our block list.

Microsoft has passed on its data of infected IP addresses to the Shadow Server Foundation, which is working with Computer Emergency Response Teams (CERTs) and ISPs across the world to clean-up the remnants of the Nitol botnet.

Operation b70 – against the Nitol botnet and other strains of malware previously distributed via the 3322.org domain – was Microsoft’s fifth disruptive action against malware as part of Redmond's ongoing Project MARS (Microsoft Active Response for Security) initiative. Previous botnet takedown operations by Redmond have targeted the Waledac, Rustock, Kelihos and Zeus botnets over the last two-and-a-half years. ®

Next gen security for virtualised datacentres

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.