Alleged Russian Malware Host Cut Off By Upstream Provider
thewhir.com
May 17, 2010
A Russian-based Internet service provider known to harbor online criminals was reportedly knocked offline Friday after its upstream provider had its service cut off.
According to a report from The New New Internet, PROXIEZ-NET hosted at least 13 known Zeus command and control channels before being set adrift by its upstream provider, DIGERNET. The Zeus Trojan (also known as Trojan.Zbot) has primarily been designed to steal confidential information from the computers it compromises, specifically targeting system information, online credentials, and banking details. It can also be customized through the toolkit to gather any sort of information by tailoring configuration files that are compiled into the Trojan installer by the attacker. Additionally, Trojan.Zbot contacts a C&C server, allowing a remote attacker to command the Trojan to download and execute further files, shutdown or reboot the computer, or even delete system files, rendering the computer unusable without reinstalling the operating system. In a BBC News interview, ZDNet UK editor Rupert Goodwins said this takedown is yet "another skirmish in the fight to decapitate the malware networks, in this case by disconnecting the control networks used to co-ordinate trojans and rootkits". He notes, however, that while this cuts off the trojan's base for receiving instructions and "to deliver its goods," the malware could find or create other connections and be back to normal. Meanwhile, PROXIEZ-NET many have been hosting some legitimate services that have been caught in the middle of this war on malware. will be adversely affected by this action.
|
