From: Oscar Abendan (AV-PH)
Sent: Thursday, March 11, 2010 6:46:09 PM
Subject: NEWSBANK: Zeus Botnet Dealt a Blow as ISP Troyak Knocked Out
Auto forwarded by a Rule
Zeus Botnet Dealt a Blow as ISP Troyak Knocked Out
Published: March 10, 2010
Two ISPs, named Troyak and Group 3, were home to 90 of the 249 known Zeus command-and-control servers. Zeus Tracker, a Web site that tracks the botnet, noticed the steep drop in servers on Wednesday morning.
The Troyak network was itself an upstream provider to six networks, known to host a large number of cybercrime servers, including Web sites used in drive-by attacks and phishing sites, according to Kevin Stevens, a researcher with SecureWorks. "There's lots of Zeus and Fragus exploit kit [sites]," he said. Whoever was behind the takedown "just decided to knock out a large area of cybercirme, and this was probably one of the easiest ways to do it."
Troyak is based in
The Zeus Tracker administrator, who asked not to be named, said that at first he thought that there had been some type of technical error in the Zeus code. On further investigation, he discovered that Troyak had been taken offline, which in turn knocked the networks hosting the botnet servers off the Internet.
This kind of ISP takedown has worked in the past. Just over a year ago, McColo, in
As with the McColo takedown, Troyak's upstream providers seem to have knocked it off the Internet, Cisco said in a statement. "The ISP was 'De-peered,'" Cisco said. "Troyak's upstream network providers effectively pulled the plug on Troyak's router, refusing to transmit its traffic."
Zeus is actually a botnet-making kit that allows cybercriminals to create their own networks of infected computers, but it has been associated with a wave of financial fraud that has caused hundreds of millions in losses to
Wednesday's takedown appears to have targeted one of the Zeus gangs, but it is remarkable in that whomever is responsible for the effort is asking not to be identified.
A security researcher who uses the pseudonym Jart Armin attributed Troyak and Group 3's disconnection to "good community action" and said that there was "more being done right now involving many, to ensure the [Zeus gang] have nowhere to go."
"Not every action is a corporate PR exercise," he said. "And we cannot get these guys by knocking off a bunch of domains via a court in
Copyright 2010 IDG. All Rights Reserved.