Microsoft, law enforcement team up for ZeroAccess botnet takedown

Share this article:

Microsoft announced on Thursday that its Digital Crimes Unit – in conjunction with the Federal Bureau of Investigation (FBI), Europol's European Cybercrime Centre (EC3) and technology companies such as A10 Networks – has disrupted a botnet that targets search engines and browsers.

“The ZeroAccess botnet has infected nearly two million computers all over the world and cost online advertisers upwards of $2.7 million each month,” Richard Domingues Boscovich, assistant general counsel with Microsoft Digital Crimes Unit, wrote in a Thursday blog post.

Boscovich compared the ZeroAccess botnet to the Bamital botnet, which was taken down in early February by the Microsoft Digital Crimes Unit in collaboration with Symantec. Both botnets hijack search results and redirect people to websites that install malware to steal personal data and fraudulently charge businesses for online advertisement clicks.

All of the major search engines and browsers – Google, Bing and Yahoo, to name a few – are targeted by ZeroAccess, Boscovich explained, adding that the majority of computers ZeroAccess has infected have been located in the U.S. and Western Europe.

Engineered to be tough against efforts to take it down, Boscovich explained that ZeroAccess relies on a peer-to-peer infrastructure. This means cyber criminals can control the botnet remotely from tens of thousands of different computers.

“Most often, computers become infected with ZeroAccess as a result of “drive-by-downloads,” where the cyber criminals create a website that downloads malware onto any unprotected computer that happens to visit that site,” Boscovich wrote.

That is not all. Boscovich added, “Computers can also become infected through counterfeit and unlicensed software, where criminals disguise ZeroAccess as legitimate software, tricking a person into downloading the ZeroAccess malware onto their computer.”

The ZeroAccess investigation is still ongoing. The botnet is so resilient and sophisticated that Microsoft does not think it will ever be wholly eliminated – however, Boscovich said he believes the joint effort has severely disrupted the malware, subsequently crippling the criminal business model.

“Because Microsoft found that the ZeroAccess malware disables security features on infected computers, leaving the computer susceptible to secondary infections, it is critical that victims rid their computers of ZeroAccess by using malware removal or anti-virus software as quickly as possible,” Boscovich wrote.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Researchers observe more than a hundred connections to 'Backoff' sinkhole

Researchers with Kaspersky Lab were able to sinkhole two command-and-control servers used by certain Backoff point-of-sale malware samples.

Judge lifts stay but Microsoft won't hand over emails during appeal

A judge has lifted a suspension of a previous order compelling Microsoft to hand over customer emails stored on a server in Ireland.

Home Depot investigates possible payment card breach

Home Depot investigates possible payment card breach

Home Depot said on Tuesday that it is working with its banking partners and law enforcement to investigate a possible data breach.