Close
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity
    • IT Management
    • Networking

    Zeus Botnet Activity Down but Far from Out

    By
    Brian Prince
    -
    March 12, 2010
    Share
    Facebook
    Twitter
    Linkedin

      The Zeus Trojan was knocked off of malware’s Mount Olympus this week when the upstream provider for six of the most notorious Zeus-hosting ISPs was taken down.

      The shutdown of Kazakhstani provider Troyak-AS March 9 is credited with cutting the number of active Zeus command-and-control servers from 249 to 181, a number that has fallen and risen again in the past few days and now stands at 191 according to the most recent figures from Zeus Tracker. Just how long the drop-off will last remains to be seen. In fact, Troyak-AS has repeatedly obtained new upstream providers of its own every time it has been disconnected.

      “After successful disconnection by Oversun Mercury and iHome, Troyak-AS obtained a new upstream provider through NAssist/YA,” Mary Landesman, senior security researcher at Cisco’s ScanSafe, told eWEEK. “That provider also disconnected their service, after which Troyak-AS moved to RTComm. Once again, they were disconnected by that provider. Currently, Troyak-AS has switched to NLine, but we anticipate they too will soon disconnect them.”

      The situation highlights a troubling pattern of security cat-and-mouse. When a particular rogue ISP is taken down, others step into its shoes, while the botnets improve the code for finding new hosts if the main command-and-control server is taken down.

      The problem is exacerbated in the case of Zeus, which is not a single botnet but a collection of thousands of variants of a Trojan that can be customized by attackers. Just recently for example, NetWitness researchers uncovered a 75,000-strong botnet built with Zeus.

      But that was just one of many, Landesman noted. Older versions of the Trojan can typically be found in the cyber-underground for free, with newer editions selling for between a few hundred and a few thousand dollars, according to research from F-Secure.

      “In short, Zeus is a vast in-the-cloud distributed network supported by multiple bot herders and millions of infected PCs,” she said. “The wide availability and ease of configuration supports multiple botnets, with space on individual segments of these botnets leased to various bidders. The success lies in this diversity and the autonomy that creates.”

      Arguably the most effective ISP takedown yet was the shutdown of McColo in 2008, which effectively killed the Srizbi botnet. Spam levels however did not stay down for long, and some suspect the owners of Srizbi may be operating other botnets, such as Rustock.

      “Since the de-peering of McColo at the end of 2008, the malware technology behind botnets has improved significantly and as a result subsequent takedowns during 2009 were less effective,” said Paul Wood, MessageLabs intelligence senior analyst for Symantec Hosted Services. “Botnets have become much harder to disrupt, often favoring HTTP as a C&C protocol with instructions in some cases now disguised as postings on social networking sites, blogs and microblogging sites.”

      There is good news, however. According to Sean Brady, product manager in the Identity Protection and Verification Group inside EMC’s RSA security division, the transition of Zeus-infected PCs to alternate services has not been particularly smooth.

      “It was observed by the evening [ET] of the 10th that systems leveraging [Troyak-AS], including the considerable volume of Zeus traffic, were beginning to route through alternate service providers [that] the fraudsters leverage as part of their efforts to keep their systems redundant,” Brady told eWEEK. “Since the 10th, these efforts have been inconsistent and somewhat unstable, and by all appearances levels have not yet bounced back to levels witnessed prior to [Troyak-AS] going dark.”

      From a long-term perspective, taking on service providers should act as a deterrent, Landesman said.

      “The continued takedowns not only disrupt the malicious hosts serviced by Troyak, it also disrupts their legitimate customers … [and] the Zeus bot controllers on this segment are also facing financial losses and perhaps additional expenses as well,” she said. “As costs of doing criminal business increase, the criminal business model becomes less profitable and hopefully less attractive.”

      Brian Prince
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.

      MOST POPULAR ARTICLES

      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Applications

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Applications

      Kyndryl’s Nicolas Sekkaki on Handling AI and...

      James Maguire - November 9, 2022 0
      I spoke with Nicolas Sekkaki, Group Practice Leader for Applications, Data and AI at Kyndryl, about how companies can boost both their AI and...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×