Feeds

Microsoft and FBI storm ramparts of Citadel botnets

Next: The hunt for evil botnet overlord 'Aquabox'

The Essential Guide to IT Transformation

The ZeuS-derived Citadel botnet, which rose to public prominence last year, is being progressively disabled by Microsoft and the FBI is on the hunt for its masters.

Microsoft says Citadel was used to raid bank accounts around the world and netted more than $US500m. Redmond's Digital Crimes Unit says 1,000 of the estimated 1,400 botnets created by Citadel have now been booted offline.

According to Reuters, institutions hit by the botnet include American Express, Bank of America, Citigroup, Credit Suisse, eBay's PayPal, HSBC, JPMorgan Chase, Royal Bank of Canada and Wells Fargo.

Citadel, whose capabilities include keylogging, emerged after the source code for the infamous ZeuS cybercrime toolkit was released in 2011. The combination of open source code and forums for virus-writers allowed it to evolve quickly, getting features such as encrypted malware configuration files and blacklisting of security vendor Websites.

Citadel was also designed to be invisible to sites tracking ZeuS – which may help explain why it's had such a long life in the wild.

Microsoft's post concedes that not all of the botnets have been taken down, but Richard Boscovich of the Digital Crimes Unit believes it will “significantly disrupt Citadel's operation”.

It was, Boscovich writes, the first time a botnet operation has involved both the private sector and law enforcement, with the FBI taking a hand to execute a civil seizure warrant to help disrupt the botnet. Data and evidence were seized from data centres in Pennsylvania and New Jersey.

Microsoft has also filed a “John Doe” civil lawsuit in North Carolina against the alleged controller of the botnet, who uses the handle Aquabox and is believed to be in Eastern Europe (partly because Citadel leaves machines in the Ukraine and Russia alone).

The FBI is also working with Europol, along with law enforcement in Australia, Brazil, Ecuador, Germany, Holland, Hong Kong, Iceland, India, Indonesia, Spain and the UK. The international effort is seeking to identify the 81 “herders” who helped Aquabox operate the botnet.

Boscovich writes: “... during our investigation we found that Citadel blocked victims’ access to many legitimate anti-virus/anti-malware sites, making it so people may not have been able to easily remove this threat from their computer. However, with the disruptive action, victims should now be able to access these previously blocked sites.

“We also found that cybercriminals are using fraudulently obtained product keys created by key generators for outdated Windows XP software to develop their malware and grow their business, demonstrating another link between software piracy and global cybersecurity threats. (Of note, Windows Vista, Windows 7 and Windows 8 have measures in place to help protect against this type of misuse of product keys.)” ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Fiendishly complex password app extension ships for iOS 8
Just slip it in, won't hurt a bit, 1Password makers urge devs
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.