Bredolab Botnet Suspect Busted in Takedown

Law enforcement officials in Armenia arrested a man Oct. 26 accused of masterminding a massive botnet operation.

According to reports, the 27-year-old suspect was arrested on suspicions of running the Bredolab botnet. Bredolab is a popular Trojan downloader used by cyber-criminals to infect Windows machines via drive-by downloads and spam e-mails.

In a takedown operation, the Dutch National Crime Squad's High Tech Crime Team (THTC) worked in collaboration with a Dutch Web hosting company, the Dutch Forensic Institute, Internet security company Fox-IT and the Dutch Computer Emergency Response Team (CERT) to seize control of 143 malicious servers tied to the botnet.

According to the THTC, the botnet network used servers in the Netherlands from a reseller of LeaseWeb, the largest hosting provider in the country. LeaseWeb fully cooperated with the takedown effort, authorities said. During the investigation, the THTC found the network was capable of infecting 3 million computers a month. At the end of 2009, it was estimated that 3.6 billion e-mails with Bredolab payloads were being spammed out daily, the THTC reported.

During the takedown, the suspect made several attempts to take back control of the botnet, according to the Dutch authorities. When this failed, police say he launched a massive distributed denial-of-service attack on LeaseWeb with 220,000 infected computers. This attack was stopped after three computer servers he was using in Paris were disconnected from the Internet, authorities said.

A Symantec advisory on Bredolab noted many of the e-mails carrying the Trojan have the following themes: Western Union free money, UPS delivery failure and Facebook password changes.

"The suspect is believed by the computer crime authorities to have rented access to infected bot computers to other cybercriminals," blogged Graham Cluley, senior technology consultant at Sophos. "No doubt the police will be interested to find out if the man has any information about others who may have exploited the botnet, and more arrests may follow."

The 27-year-old was arrested at the international airport in Yerevan, authorities said.