Tweet
Suspected Bredolab worm mastermind arrested in Armenia
A 27-year-old Armenian citizen, suspected of masterminding a computer worm that infected at least 30m computers worldwide, stealing financial information and sending out billions of malicious emails, has been arrested.
Police in the Netherlands have seized and disconnected 143 computer servers that were being used by cybercriminals to co-ordinate one of the largest "botnet" attacks ever recorded. The malicious worm, named Bredolab, could infect up to 3 million computers a month and send out more than 3.6 billion infected emails a day.
Infected machines will receive a notice detailing the extent of damage inflicted and advice on removing it at the time of the next login, the Dutch national crime squad confirmed.
The 143 servers being used as a base for the attack are owned by the Dutch hosting provider LeaseWeb. The company identified the malicious use of a small portion of its servers in the summer, a day before Dutch authorities ordered LeaseWeb not to immediately destroy the botnet so that it could be forensically investigated.
Today, Dutch police confirmed that an Armenian citizen, aged 27, has been arrested as the suspected mastermind behind the Bredolab network. Police declined to reveal the gender of the suspect, who was arrested at Yerevan airport on Monday evening and is being held in Armenia.
Dutch authorities today said that the suspect made several attempts to retain control of the botnet after police seized and disconnected its servers.
As a last throw of the dice, authorities said the suspect used 220,000 infected computers to orchestrate a so-called "distributed denial of service" (DDoS) attack against LeaseWeb.
A typical email sent out by a Bredolab-infected machine would contain "news" of the death of a celebrity and invite recipients to open the attached file. Once the attachment is opened the machine becomes infected.
The Bredolab virus takes complete remote control of a computer and has the ability to obtain sensitive information by recording keystrokes, accessing files, passwords and a user's financial data. Previously, cybercriminals have targeted users of the social networking sites Facebook and MySpace with the Bredolab worm.
Early indications from security experts suggest that Bredolab has been almost completely stopped in its tracks by the actions of the Dutch police. Prior to 29 September, Trend Micro recorded an average of 200 Bredolab samples a day from its monitors – that figure fell dramatically to just four a day after this date.
Alex De Joode, head of security at LeaseWeb, one of Europe's largest hosting providers, said the botnet had evaded detection because of its "highly sophisticated" method of lying under the radar.
"Basically, this was a factory where you could buy, for example, 10,000 infections in the UK and a cybercriminal could upload a trojan or piece of software that could infect RBS or any bank and go on to attack British IP addresses," he said.
"It is very significant, as the malware writer could specifically target their audience. Instead of sending an RBS trojan to Uzbekistan, they could direct it to the UK. It was also highly sophisticated because the interaction went through proxies, so there was no connection through LeaseWeb – it did not arouse suspicion because there was no irregular traffic patterns."
De Joode said it was hard to estimate the scale of the damage done, or the amount of sensitive information collected, by those behind the attack at this stage, saying it was only clear that 30m computers around the world are capable of spreading the malware.
Rik Ferguson, a senior security advisor at Trend Micro, said that his analysts tracked down the origination of Bredolab to Russia.
"Bredolab was truly a global criminal distribution software network," he said. "It rose very quickly in prominence around August 2009, so we set up monitoring straight away. Interestingly, [Bredolab] tried pretty much every avenue possible to infect machines – including 'drive-by downloads', and installing other malware."
Police in the Netherlands have seized and disconnected 143 computer servers that were being used by cybercriminals to co-ordinate one of the largest "botnet" attacks ever recorded. The malicious worm, named Bredolab, could infect up to 3 million computers a month and send out more than 3.6 billion infected emails a day.
Infected machines will receive a notice detailing the extent of damage inflicted and advice on removing it at the time of the next login, the Dutch national crime squad confirmed.
The 143 servers being used as a base for the attack are owned by the Dutch hosting provider LeaseWeb. The company identified the malicious use of a small portion of its servers in the summer, a day before Dutch authorities ordered LeaseWeb not to immediately destroy the botnet so that it could be forensically investigated.
Today, Dutch police confirmed that an Armenian citizen, aged 27, has been arrested as the suspected mastermind behind the Bredolab network. Police declined to reveal the gender of the suspect, who was arrested at Yerevan airport on Monday evening and is being held in Armenia.
Dutch authorities today said that the suspect made several attempts to retain control of the botnet after police seized and disconnected its servers.
As a last throw of the dice, authorities said the suspect used 220,000 infected computers to orchestrate a so-called "distributed denial of service" (DDoS) attack against LeaseWeb.
A typical email sent out by a Bredolab-infected machine would contain "news" of the death of a celebrity and invite recipients to open the attached file. Once the attachment is opened the machine becomes infected.
The Bredolab virus takes complete remote control of a computer and has the ability to obtain sensitive information by recording keystrokes, accessing files, passwords and a user's financial data. Previously, cybercriminals have targeted users of the social networking sites Facebook and MySpace with the Bredolab worm.
Early indications from security experts suggest that Bredolab has been almost completely stopped in its tracks by the actions of the Dutch police. Prior to 29 September, Trend Micro recorded an average of 200 Bredolab samples a day from its monitors – that figure fell dramatically to just four a day after this date.
Alex De Joode, head of security at LeaseWeb, one of Europe's largest hosting providers, said the botnet had evaded detection because of its "highly sophisticated" method of lying under the radar.
"Basically, this was a factory where you could buy, for example, 10,000 infections in the UK and a cybercriminal could upload a trojan or piece of software that could infect RBS or any bank and go on to attack British IP addresses," he said.
"It is very significant, as the malware writer could specifically target their audience. Instead of sending an RBS trojan to Uzbekistan, they could direct it to the UK. It was also highly sophisticated because the interaction went through proxies, so there was no connection through LeaseWeb – it did not arouse suspicion because there was no irregular traffic patterns."
De Joode said it was hard to estimate the scale of the damage done, or the amount of sensitive information collected, by those behind the attack at this stage, saying it was only clear that 30m computers around the world are capable of spreading the malware.
Rik Ferguson, a senior security advisor at Trend Micro, said that his analysts tracked down the origination of Bredolab to Russia.
"Bredolab was truly a global criminal distribution software network," he said. "It rose very quickly in prominence around August 2009, so we set up monitoring straight away. Interestingly, [Bredolab] tried pretty much every avenue possible to infect machines – including 'drive-by downloads', and installing other malware."
Comment