More recently, the malware has been linked to ransomware gangs Ryuk, DarkSide and BlackMatter. "Affiliates are then responsible for bot distribution and maintaining their botnets." "When purchased, affiliates are given all they need to set up their own servers with administration panels and to start building their bots," security firm ESET explained. ZLoader is also sold on underground forums along with other types of commodity malware. Ryuk ransomware recovery cost us $8.1m and counting, says Baltimore school authority.Feds take down Kremlin-backed Cyclops Blink botnet.Stolen-data market RaidForums taken down in domain seizure.
#RESELL AVAST PRICING WINDOWS#
Microsoft details how China-linked crew's malware hides scheduled Windows tasks.ZLoader is likely to be revived soon as well, since it has proven very popular so far and there's a lot of money to be made. In October 2020 Microsoft launched a similar operation against the Trickbot network, but it was back up and running within two weeks, the US Cybersecurity and Infrastructure Security Agency warned in an advisory. While the newly announced operation will have severely inconvenienced the botnet's operators, based on past experience they'll be back. It also thanked the Financial Services Information Sharing and Analysis Centers (FS-ISAC) and the Health Information Sharing and Analysis Center (H-ISAC) for "additional data and insights." Microsoft was keen to stress this was a cooperative effort, with security shops ESET, Lumen's threat-intel arm Black Lotus Labs, Palo Alto Networks' Unit 42's team and Avast Threat Labs helping out. These include defense, like disabling security and antivirus tools to evade detection, and offensive capabilities such as "capturing screenshots, collecting cookies, stealing credentials and banking data, performing reconnaissance, launching persistence mechanisms, misusing legitimate security tools, and providing remote access to attackers," according to the Microsoft's 365 Defender Threat Intelligence Team. While its earlier use was primarily to steal account login IDs and passwords for financial theft, it has evolved over the years and added new capabilities. ZLoader is a variant of the Zeus banking trojan that has been around for at least 15 years. "We chose to name an individual in connection with this case to make clear that cybercriminals will not be allowed to hide behind the anonymity of the internet to commit their crimes," wrote Amy Hogan-Burney, general manager of Microsoft's Digital Crimes Unit.
The trademark infringement being that at least one of the domains was used for a website that featured Microsoft trademarks in an attempt to masquerade as a legit Redmond site, and also references in phishing emails to Microsoft-trademarked programs, such as Excel. The tech giant's Digital Crimes Unit obtained a court order from a US federal judge in Georgia to take down the domains, which are now directed to a Microsoft-controlled sinkhole so they can't be used by the malware's masterminds to communicate with their botnet of commandeered Windows computers.įrom what we can tell from the filings submitted by Microsoft to the courts, its justification for the seizure is that ZLoader used the domains to injure the Windows giant as well as residents of the US state and commit computer fraud, infringement of Microsoft trademarks, and other illegal activity. Microsoft has announced a months-long effort to take control of 65 domains that the ZLoader criminal botnet gang has been using to spread the remote-control malware and orchestrate infected machines.
0 kommentar(er)
