Microsoft, law enforcement team up for ZeroAccess botnet takedown

Share this article:

Microsoft announced on Thursday that its Digital Crimes Unit – in conjunction with the Federal Bureau of Investigation (FBI), Europol's European Cybercrime Centre (EC3) and technology companies such as A10 Networks – has disrupted a botnet that targets search engines and browsers.

“The ZeroAccess botnet has infected nearly two million computers all over the world and cost online advertisers upwards of $2.7 million each month,” Richard Domingues Boscovich, assistant general counsel with Microsoft Digital Crimes Unit, wrote in a Thursday blog post.

Boscovich compared the ZeroAccess botnet to the Bamital botnet, which was taken down in early February by the Microsoft Digital Crimes Unit in collaboration with Symantec. Both botnets hijack search results and redirect people to websites that install malware to steal personal data and fraudulently charge businesses for online advertisement clicks.

All of the major search engines and browsers – Google, Bing and Yahoo, to name a few – are targeted by ZeroAccess, Boscovich explained, adding that the majority of computers ZeroAccess has infected have been located in the U.S. and Western Europe.

Engineered to be tough against efforts to take it down, Boscovich explained that ZeroAccess relies on a peer-to-peer infrastructure. This means cyber criminals can control the botnet remotely from tens of thousands of different computers.

“Most often, computers become infected with ZeroAccess as a result of “drive-by-downloads,” where the cyber criminals create a website that downloads malware onto any unprotected computer that happens to visit that site,” Boscovich wrote.

That is not all. Boscovich added, “Computers can also become infected through counterfeit and unlicensed software, where criminals disguise ZeroAccess as legitimate software, tricking a person into downloading the ZeroAccess malware onto their computer.”

The ZeroAccess investigation is still ongoing. The botnet is so resilient and sophisticated that Microsoft does not think it will ever be wholly eliminated – however, Boscovich said he believes the joint effort has severely disrupted the malware, subsequently crippling the criminal business model.

“Because Microsoft found that the ZeroAccess malware disables security features on infected computers, leaving the computer susceptible to secondary infections, it is critical that victims rid their computers of ZeroAccess by using malware removal or anti-virus software as quickly as possible,” Boscovich wrote.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.