Takeover of Virut domains

(Publication) Google search: [1]

Takeover of Virut domains
Botnet	Virut
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2013 / 2013-02-21
Editor/Conference	CERT Polska
Link	http://www.cert.pl/news/6744/langswitch lang/en (Archive copy)
Author
Type	White paper

Abstract

“ At the end of January and the beginning of February 2013 NASK (Research and Academic

Computer Network) { the .pl ccTLD Registry { and its security team CERT Polska took over 43 .pl domains used to control the Virut botnet and to spread malicious applications. These actions were preceded by a detailed legal and technical analyses and were supported by Spamhaus and VirusTotal. Some of these domains, even outside .pl domain, were an important part of the botnet infrastructure. As a result of these actions, all traffic from infected computers to the Command and Control servers were redirected to the sinkhole server controlled by CERT Polska. The action cripples criminals ability to control infected machines and allows to gather information about infected machines. This data is shared with all interested partners. From the gathered data, on average 270 thousand unique IP addresses connect to the botnet server every day, which is a good estimation of the botnet size at the day of takeover. Almost a half of infected machines are located in three countries: Egypt, Pakistan and India. Poland is located at the 19th place on the infection scale. This report presents the actions taken by NASK, methods used to gather data and their analysis, which offer additional insight into Virut activity, including a connection to the sale of fake antivirus applications.

Bibtex

 @misc{empty2013BFR1307,
   editor = {CERT Polska},
   author = {},
   title = {Takeover of Virut domains},
   date = {21},
   month = Feb,
   year = {2013},
   howpublished = {\url{http://www.cert.pl/news/6744/langswitch_lang/en}},
 }