Microsoft, law enforcement team up for ZeroAccess botnet takedown

Share this article:

Microsoft announced on Thursday that its Digital Crimes Unit – in conjunction with the Federal Bureau of Investigation (FBI), Europol's European Cybercrime Centre (EC3) and technology companies such as A10 Networks – has disrupted a botnet that targets search engines and browsers.

“The ZeroAccess botnet has infected nearly two million computers all over the world and cost online advertisers upwards of $2.7 million each month,” Richard Domingues Boscovich, assistant general counsel with Microsoft Digital Crimes Unit, wrote in a Thursday blog post.

Boscovich compared the ZeroAccess botnet to the Bamital botnet, which was taken down in early February by the Microsoft Digital Crimes Unit in collaboration with Symantec. Both botnets hijack search results and redirect people to websites that install malware to steal personal data and fraudulently charge businesses for online advertisement clicks.

All of the major search engines and browsers – Google, Bing and Yahoo, to name a few – are targeted by ZeroAccess, Boscovich explained, adding that the majority of computers ZeroAccess has infected have been located in the U.S. and Western Europe.

Engineered to be tough against efforts to take it down, Boscovich explained that ZeroAccess relies on a peer-to-peer infrastructure. This means cyber criminals can control the botnet remotely from tens of thousands of different computers.

“Most often, computers become infected with ZeroAccess as a result of “drive-by-downloads,” where the cyber criminals create a website that downloads malware onto any unprotected computer that happens to visit that site,” Boscovich wrote.

That is not all. Boscovich added, “Computers can also become infected through counterfeit and unlicensed software, where criminals disguise ZeroAccess as legitimate software, tricking a person into downloading the ZeroAccess malware onto their computer.”

The ZeroAccess investigation is still ongoing. The botnet is so resilient and sophisticated that Microsoft does not think it will ever be wholly eliminated – however, Boscovich said he believes the joint effort has severely disrupted the malware, subsequently crippling the criminal business model.

“Because Microsoft found that the ZeroAccess malware disables security features on infected computers, leaving the computer susceptible to secondary infections, it is critical that victims rid their computers of ZeroAccess by using malware removal or anti-virus software as quickly as possible,” Boscovich wrote.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.

Professor says Google search, not hacking, yielded medical info

Professor says Google search, not hacking, yielded medical ...

A professor of ethical hacking at City College San Francisco came forward to clarify that he did not demonstrate hacking a medical center's server in a class.

Syrian Malware Team makes use of enhanced BlackWorm RAT

Syrian Malware Team makes use of enhanced BlackWorm ...

FireEye analyzed the hacking group's use of the malware, dubbed the "Dark Edition" of BlackWorm.