The takedown of 100 servers used to control Zeus-related botnets may be a short-lived victory, security researchers said after discovering that about a third of the orphaned channels were able to regain connectivity in less than 48 hours.
The resurrection of at least 30 command and control channels came after their internet service provider found a new upstream provider to provide connectivity to the outside world, autonomous system records showed on Thursday. As a result, some of the rogue customers who used the Troyak ISP to herd huge numbers of infected PCs were able to once again connect to the compromised machines and issue commands.
"The problem is that as soon the C&Cs are reachable from the internet again, the cybercriminals can regain the control of their botnet and can safely move the stolen data away from those AS's to a safer place or to a backup server," a researcher connected to the Zeus Tracker service told The Register. "Very bad."
[...]
The resurrections are in many cases the result of Troyak being reconnected by upstream provider RTCOMM-AS of Moscow. As previously reported, Troyak was completely severed from the net when its previous providers, Ukraine-based Ihome and Russia-based Oversun Mercury, suddenly "de-peered" their customer. Troyak's resiliency demonstrates the whack-a-mole nature of internet takedowns, in which alleged bad guys are able to quickly come back online by switching to a new provider.
For their part, Troyak principals characterized the de-peering as the result of an inadvertent failure to pay bills on time, rather than a termination based on the customers it served.
-----------------------
The statistics over @ ZeuS Tracker as showing an increase of ZeuS' online components (configs, binaries, dropzones, and domains) after the drip caused by the de-peering action.
https://zeustracker.abuse.ch/statistic.php
No comments:
Post a Comment