Microsoft announced on Thursday that its Digital Crimes Unit – in conjunction with the Federal Bureau of Investigation (FBI), Europol's European Cybercrime Centre (EC3) and technology companies such as A10 Networks – has disrupted a botnet that targets search engines and browsers.
“The ZeroAccess botnet has infected nearly two million computers all over the world and cost online advertisers upwards of $2.7 million each month,” Richard Domingues Boscovich, assistant general counsel with Microsoft Digital Crimes Unit, wrote in a Thursday blog post.
Boscovich compared the ZeroAccess botnet to the Bamital botnet, which was taken down in early February by the Microsoft Digital Crimes Unit in collaboration with Symantec. Both botnets hijack search results and redirect people to websites that install malware to steal personal data and fraudulently charge businesses for online advertisement clicks.
All of the major search engines and browsers – Google, Bing and Yahoo, to name a few – are targeted by ZeroAccess, Boscovich explained, adding that the majority of computers ZeroAccess has infected have been located in the U.S. and Western Europe.
Engineered to be tough against efforts to take it down, Boscovich explained that ZeroAccess relies on a peer-to-peer infrastructure. This means cyber criminals can control the botnet remotely from tens of thousands of different computers.
“Most often, computers become infected with ZeroAccess as a result of “drive-by-downloads,” where the cyber criminals create a website that downloads malware onto any unprotected computer that happens to visit that site,” Boscovich wrote.
That is not all. Boscovich added, “Computers can also become infected through counterfeit and unlicensed software, where criminals disguise ZeroAccess as legitimate software, tricking a person into downloading the ZeroAccess malware onto their computer.”
The ZeroAccess investigation is still ongoing. The botnet is so resilient and sophisticated that Microsoft does not think it will ever be wholly eliminated – however, Boscovich said he believes the joint effort has severely disrupted the malware, subsequently crippling the criminal business model.
“Because Microsoft found that the ZeroAccess malware disables security features on infected computers, leaving the computer susceptible to secondary infections, it is critical that victims rid their computers of ZeroAccess by using malware removal or anti-virus software as quickly as possible,” Boscovich wrote.
