International team takes down virus-spewing Andromeda botnet

Infections spread across over 200 regions


Police and private companies have taken down a massive botnet used to move malware onto compromised PCs.

The Andromeda botnet, also known as Gamarue, is thought to have spanned over two million PCs and distributed over 80 types of malware onto infected PCs. It was shut down on November 29 in a combined operation by Europol, the FBI, security vendor ESET and Microsoft.

A suspect thought to be associated with the botnet was arrested in Belarus.

"This is another example of international law enforcement working together with industry partners to tackle the most significant cyber criminals and the dedicated infrastructure they use to distribute malware on a global scale," said Steven Wilson, the Head of Europol's European Cybercrime Centre.

"The clear message is that public-private partnerships can impact these criminals and make the internet safer for all of us."

The Andromeda takedown was made possible by last year's operations to close the Avalanche botnet. During that effort German police found important information about Andromeda on one of the computers seized during the anti-Avalanche operation and passed the details on to Europol.

botnet

Online criminals iced as cops bury malware-spewing Avalanche

READ MORE

Traffic from Andromeda-infected PCs has now been disrupted, with the authorities taking control of 1,500 malicious domains employed by the malware. Microsoft noted that these domains were contacted by over two million IP addresses in 223 counties and municipalities.

The Andromeda malware first appeared in September 2011 and was detected and blocked on over a million PCs last month. The code's primary purpose was to harvest credentials but the malware's highly modular design allowed operators to add in their own custom modules for things like web page content theft or spam campaigns.

Researchers at Microsoft and ESET spent 18 months following the Wauchos malware used to build the botnet to identify its command and control mechanisms. They then moved, with police help, to take control of the domains used to control the botnet and hopefully it won't be restarted.

"In the past, Wauchos has been the most detected malware family amongst ESET users, so when we were approached by Microsoft to take part in a joint disruption effort against it, to better protect our users and the general public at large, it was a no-brainer to agree," said Jean-Ian Boutin, senior malware researcher at ESET.

"This particular threat has been around for several years now and it is constantly reinventing itself – which can make it hard to monitor. But by using ESET Threat Intelligence and by working collaboratively with Microsoft researchers, we have been able to keep track of changes in the malware's behavior and consequently provide actionable data which has proven invaluable in these takedown efforts." ®


Other stories you might like

  • Yet again, Cream Finance skimmed by crooks: $130m in crypto assets stolen

    Third time's the unlucky charm for loan outfit

    Decentralized finance biz Cream Finance became further decentralized on Wednesday with the theft of $130m worth of crypto assets from its Ethereum lending protocol.

    Cream (cream.finance and not creamfinance.com) reported the loss via Twitter, the third such incident for the loan platform this year.

    "Our Ethereum C.R.E.A.M. v1 lending markets were exploited and liquidity was removed on October 27, 1354 UTC," the Taiwan-based biz said. "The attacker removed a total of ~$130m USD worth of tokens from these markets, using this address. No other markets were impacted."

    Continue reading
  • OpenID-based security features added to GitHub Actions as usage doubles

    Single-use tokens and reusable workflows explained at Universe event

    GitHub Universe GitHub Actions have new security based on OpenID, along with the ability to create reusable workflows, while usage has nearly doubled year on year, according to presentations at the Universe event.

    The Actions service was previewed three years ago at Universe 2018, and made generally available a year later. It was a huge feature, building automation into the GitHub platform for the first time (though rival GitLab already offered DevOps automation).

    It require compute resources, called runners, which can be GitHub-hosted or self-hosted. Actions are commands that execute on runners. Jobs are a sequence of steps that can be Actions or shell commands. Workflows are a set of jobs which can run in parallel or sequentially, with dependencies. For example, that deployment cannot take place unless build and test is successful. Actions make it relatively easy to set up continuous integration or continuous delivery, particularly since they are cloud-hosted and even a free plan offers 2,000 automation minutes per month, and more than that for public repositories.

    Continue reading
  • REvil gang member identified living luxury lifestyle in Russia, says German media

    Die Zeit: He's got a Beemer, a Bitcoin watch and a swimming pool

    German news outlets claim to have identified a member of the infamous REvil ransomware gang – who reportedly lives the life of Riley off his ill-gotten gains.

    The gang member, nicknamed Nikolay K by Die Zeit newspaper and the Bayerische Rundfunk radio station, reportedly owns a €70,000 watch with a Bitcoin address engraved on its face and rents yachts for €1,300 a day whenever he goes on holiday.

    "He seems to prefer T-shirts from Gucci, luxurious BMW sportscars and large sunglasses," reported Die Zeit, which partly identified him through social media videos posted by his wife.

    Continue reading

Biting the hand that feeds IT © 1998–2021