Feeds

Chinese Nitol botnet host back up after Microsoft settles lawsuit

Owner agrees to chuck nasties down the sinkhole

Top 5 reasons to deploy VMware with Tegile

Microsoft has reached a settlement with the Chinese site linked to the Nitol DDoS botnet.

The emerging Nitol botnet was hosted by the 3322.org domain. In order to stem the threat, Microsoft filed a suit to take control of the 70,000 malicious subdomains hosted on 3322.org, gaining control of the domain in mid September.

Redmond uncovered the scam during an investigation (PDF) into insecure supply chains. It seems that corrupt (but unnamed) computer resellers in China were planting malware on victims' machines as a means to make extra money from pay-per-install malware affiliate programs and similar scams.

The 3322.org played host to a multitude of backdoors, Trojans and other strains of malware as well as Nitol prior to the Redmond-initiated enforcement action.

The operator of 3322.org, Peng Yong, recently agreed to work in cooperation with Microsoft and the Chinese Computer Emergency Response Team (CN-CERT) to fight cybercrime. Based on this settlement agreement, Redmond allowed the 3322.org domain to resume operations, on condition that that any sub-domains linked to malware are placed on a "block-list" and redirected to a sink-hole managed by Microsoft. 3322.org also agreed to help identify computer users in China left infected by the earlier spread of the Nitol botnet and other malware strains tied to 3322.org.

"We’re very pleased by this outcome, which will help guarantee that the 70,000 malicious subdomains associated with 3322.org will never again be used for cybercrime," Richard Domingues Boscovich, assistant general counsel at Microsoft's Digital Crimes Unit, writes in a blog post announcing the settlement.

In the 16 days since we began collecting data on the 70,000 malicious subdomains, we have been able to block more than 609 million connections from over 7,650,000 unique IP addresses to those malicious 3322.org subdomains. In addition to blocking connections to the malicious domains, we have continued to provide DNS services for the unblocked 3322.org subdomains. For example, on Sept 25, we successfully processed 34,954,795 DNS requests for 3322.org subdomains that were not on our block list.

Microsoft has passed on its data of infected IP addresses to the Shadow Server Foundation, which is working with Computer Emergency Response Teams (CERTs) and ISPs across the world to clean-up the remnants of the Nitol botnet.

Operation b70 – against the Nitol botnet and other strains of malware previously distributed via the 3322.org domain – was Microsoft’s fifth disruptive action against malware as part of Redmond's ongoing Project MARS (Microsoft Active Response for Security) initiative. Previous botnet takedown operations by Redmond have targeted the Waledac, Rustock, Kelihos and Zeus botnets over the last two-and-a-half years. ®

Remote control for virtualized desktops

More from The Register

next story
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Mozilla, EFF, Cisco back free-as-in-FREE-BEER SSL cert authority
Let’s Encrypt to give HTTPS-everywhere a boost in 2015
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
Got an iPhone or iPad? LOOK OUT for MASQUE-D INTRUDERS
UNjailbroken iOS 7, 8 open to evil, says secbiz FireEye
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.