2011

(Year/Month)

Botnets

• Starting in 2011: DarkMegi, Dorkbot, Flashback, Gauss, MP-DDoser, Madi, Pobelka, Ransom.EY, Shylock, Skunkx, TDL-4
• Ending in 2011: DNSChanger

Publications

	Author	Editor	Botnet	Campaign
Advancing the fight against botnets with consumer notifications	Kevin Sullivan	Microsoft
Aldi Bot - bka.de DDoS	Y0y0bkabkay0y0	Youtube	Aldi Bot
An analysis of underground forums	Marti Motoyama Damon McCoy Kirill Levchenko Stefan Savage Geoffrey M. Voelker	Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference
Analysis of ngrBot	Kimberly	StopMalvertising	Dorkbot
Analysis: Malware Win32/Rimecud.B	Bharat Jogi Qualys Security Labs		Butterfly
Apple took 3 years to fix Finfisher trojan hole	Brian Krebs	Brian Krebs	Finfisher
BareBox: efficient malware analysis on bare-metal	Christopher Kruegel Giovanni Vigna Dhilung Kirat	Annual Computer Security Applications Conference
Battling the Rustock threat	Marc Lauricella Holly Stewart T.J. Campana David Anselmi Richard Boscovich Samantha Doerr Oleg Petrovsky Tareq Saade	Microsoft	Rustock
Bot of the day: Ramnit/Ninmul	Matthew Jonkman
Botnet operation disabled		FBI	Coreflood
Botnet shutdown success story: how Kaspersky Lab disabled the Hlux/Kelihos botnet	Tillmann Werner	Kaspersky lab	Kelihos
Botnets on discount!	Inconnu	GData	Aldi Bot
Carberp + BlackHole = growing fraud incidents	David Harley Aleksandr Matrosov Eugene Rodionov Dmitry Volkov	ESET	Carberp
Carberp - a modular information stealing trojan	Andrea Allievi Marco Giuliani	Prevx	Carberp
Carberp reverse engineering	Giuseppe Bonfa	Università Italiana Cracking	Carberp
Carberp: Silent trojan, eventual successor to ZeuS	Carlos Zevallos	InfoSpyware	SpyEye Carberp ZeuS
Chapro.A source code
Coordinated DDoS attack during Russian Duma elections	Hal Roberts Bruce Etling	Berkman Center
Coreflood botnet - Detection and remediation	André M. DiMino		Coreflood
Cracking into the new P2P variant of Zeusbot/Spyeye	Andrea Lelli	Symantec	SpyEye ZeuS
DDoS watch: keeping an eye on Aldi Bot	Curt Wilson	Arbor Networks	Aldi Bot
Darkness DDoS bot version identification guide	Mila Parkour André M. DiMino	Shadowserver Foundation	Darkness
Department of Justice takes action to disable international botnet		US Department of Justice	Coreflood
Disorderly conduct: localized malware impersonates the police	Horea Coroiu	Microsoft	Cutwail Gema
DroidLive New SMS Android Trojan	Xuxian Jiang	CS State University
Duqu FAQ	Ryan Naraine	Kaspersky lab	Duqu Stuxnet
Egypt Finfisher intrusion tools and ethics	Mikko Hypponen	F-Secure	Finfisher
Encyclopedia entry: Win32/Carberp	Shawn Wang	Microsoft Malware Protection Centre	Carberp
Encyclopedia entry: Win32/Conficker	Joshua Phillips Jireh Sanico Vincent Tiu Aaron Putnam	Microsoft Malware Protection Centre	Conficker
Esthost taken down - Biggest cybercriminal takedown in history	Feike Hacquebord	Trend Micro	DNSChanger	Esthost
Evolution of Win32Carberp: going deeper	David Harley Aleksandr Matrosov Eugene Rodionov Dmitry Volkov	ESET	Carberp
FBI shuts down Coreflood botnet, zombies transmitting financial data	Fahmida Y. Rashid	Ziff Davis Enterprise	Coreflood
GingerMaster Android Malware Utilizing A Root Exploit	Xuxian Jiang	CS State University
HARMUR: storing and analyzing historic data on malicious domains	Marco Cova Corrado Leita	ACM
HTran and the Advanced Persistent Threat	Joe Stewart	DELL SecureWorks
Harnig botnet: a retreating army	Atif Mushtaq	FireEye	SpyEye ZeuS Harnig Ertfor
Harnig is back	Atif Mushtaq	FireEye	Rustock Harnig
Herpes botnet	Xylitol		HerpesNet
Hodprot: hot to bot	Aleksandr Matrosov Eugene Rodionov Dmitry Volkov	ESET	Carberp Hodprot Sheldor RDPdoor Gamker
Inside Carberp botnet	Francisco Ruiz	Malware Intelligence	Carberp
International cyber ring that infected millions of computers dismantled	Press Office	FBI	DNSChanger	Esthost
Latin American banks under fire from the Mexican VOlk-botnet	Jorge Mieres	Kaspersky lab	VOlk
Malware for everyone - Aldi Bot at a discount price	Chris von Eitzen	Heise Media	Aldi Bot
Microsoft neutralizes Kelihos botnet, names defendant in case	Richard Domingues Boscovich	Microsoft	Kelihos
Morto worm sets a (DNS) record	Cathal Mullaney	Symantec	Morto
New IceIX (ZeuS variant) changes its encryption method (again)	Andreas Baumhof	TrustDefender Labs	ZeuS IceIX
Ngrbot steals information and mine Bitcoins	SonicWALL UTM research team	SonicWALL	Dorkbot
On botnets that use DNS for command and control	Felix C. Freiling Christian J. Dietrich Christian Rossow Herbert Bos Maarten van Steen Norbert Pohlmann	Institute for Internet Security University of Applied Sciences Gelsenkirchen Gelsenkirchen, Germany	Agobot SDBot RBot ZeuS Koobface Sality Swizzor Virut Feederbot
Overview: inside the ZeuS trojan’s source code	Steve Ragan	The Tech Herald	ZeuS
Proactive detection of network security incidents	Katarzyna Gorzelak Tomasz Grudziecki Paweł Jacewicz Przemysław Jaroszewski Łukasz Juszczyk Piotr Kijewski	Enisa
... further results