Chinese Nitol botnet host back up after Microsoft settles lawsuit

Microsoft has reached a settlement with the Chinese site linked to the Nitol DDoS botnet.

The emerging Nitol botnet was hosted by the 3322.org domain. In order to stem the threat, Microsoft filed a suit to take control of the 70,000 malicious subdomains hosted on 3322.org, gaining control of the domain in mid September.

Redmond uncovered the scam during an investigation (PDF) into insecure supply chains. It seems that corrupt (but unnamed) computer resellers in China were planting malware on victims' machines as a means to make extra money from pay-per-install malware affiliate programs and similar scams.

The 3322.org played host to a multitude of backdoors, Trojans and other strains of malware as well as Nitol prior to the Redmond-initiated enforcement action.

The operator of 3322.org, Peng Yong, recently agreed to work in cooperation with Microsoft and the Chinese Computer Emergency Response Team (CN-CERT) to fight cybercrime. Based on this settlement agreement, Redmond allowed the 3322.org domain to resume operations, on condition that that any sub-domains linked to malware are placed on a "block-list" and redirected to a sink-hole managed by Microsoft. 3322.org also agreed to help identify computer users in China left infected by the earlier spread of the Nitol botnet and other malware strains tied to 3322.org.

"We’re very pleased by this outcome, which will help guarantee that the 70,000 malicious subdomains associated with 3322.org will never again be used for cybercrime," Richard Domingues Boscovich, assistant general counsel at Microsoft's Digital Crimes Unit, writes in a blog post announcing the settlement.

In the 16 days since we began collecting data on the 70,000 malicious subdomains, we have been able to block more than 609 million connections from over 7,650,000 unique IP addresses to those malicious 3322.org subdomains. In addition to blocking connections to the malicious domains, we have continued to provide DNS services for the unblocked 3322.org subdomains. For example, on Sept 25, we successfully processed 34,954,795 DNS requests for 3322.org subdomains that were not on our block list.

Microsoft has passed on its data of infected IP addresses to the Shadow Server Foundation, which is working with Computer Emergency Response Teams (CERTs) and ISPs across the world to clean-up the remnants of the Nitol botnet.

Operation b70 – against the Nitol botnet and other strains of malware previously distributed via the 3322.org domain – was Microsoft’s fifth disruptive action against malware as part of Redmond's ongoing Project MARS (Microsoft Active Response for Security) initiative. Previous botnet takedown operations by Redmond have targeted the Waledac, Rustock, Kelihos and Zeus botnets over the last two-and-a-half years. ®