Dutch authorities revealed details of their offensive against the Bredolab botnet, which culminated in the arrest of a 27-year-old man in Armenia.
Law enforcement officials in Armenia
arrested a man Oct. 26 accused of masterminding a massive botnet
According to reports, the 27-year-old suspect was arrested on suspicions
of running the Bredolab botnet. Bredolab
is a popular Trojan downloader
used by cyber-criminals to infect
Windows machines via drive-by downloads and spam e-mails.
In a takedown operation, the Dutch National Crime Squad's High Tech Crime
Team (THTC) worked in collaboration with a Dutch Web hosting company, the Dutch
Forensic Institute, Internet security company Fox-IT and the Dutch Computer
Emergency Response Team (CERT) to seize control of 143 malicious servers tied
to the botnet.
to the THTC
, the botnet network used servers in the Netherlands
from a reseller of LeaseWeb, the largest hosting provider in the country.
LeaseWeb fully cooperated with the takedown effort, authorities said. During
the investigation, the THTC found the network was capable
of infecting 3 million
computers a month. At the end of 2009, it was
estimated that 3.6 billion e-mails with Bredolab payloads were being spammed
out daily, the THTC reported.
During the takedown, the suspect made several attempts to take back control
of the botnet, according to the Dutch authorities. When this failed, police say
he launched a massive distributed denial-of-service attack on LeaseWeb with
220,000 infected computers. This attack was stopped after three computer
servers he was using in Paris were
disconnected from the Internet, authorities said.
A Symantec advisory on Bredolab noted many of the e-mails carrying the
Trojan have the following themes: Western Union free
money, UPS delivery failure and Facebook
"The suspect is believed by the computer crime authorities to have
rented access to infected bot computers to other cybercriminals," blogged
Graham Cluley, senior technology consultant at Sophos. "No doubt the
police will be interested to find out if the man has any information about
others who may have exploited the botnet, and more arrests may follow."
The 27-year-old was arrested at the international airport in Yerevan,