New Zeus Botnet Variant Targets Firefox

A new version of the data-stealing trojan Zeus is for the first time able to successfully exploit Mozilla’s Firefox browser to commit sophisticated online banking fraud. Read the full article. Secure Computing...

Zeus Botnet Exploiting PDF Flaw

The Zeus botnet is now using an unpatched flaw in Adobe’s PDF document format to infect users with malicious code, said security researchers. Read the full article. Computerworld...

New P2P Botnet Forming

Security researchers have identified a newly formed botnet that comprises machines infected with a Trojan specifically designed to manage the downloading and installation of a spectrum of other malicious software. The Trojan, known as Heloag, installs itself on PCs after being downloaded from one...

Spyware Botnet 'GhostNet' Uses The Cloud

Espionage network GhostNet, first identified about a year ago, is much larger and more sophisticated than previously assumed according to a study entitled “Shadows in the Cloud”, by the Munk Centre for International Studies, the Information Warfare Monitor, the SecDev Group and the Shadowserver...

DHS Studying Global Response to Conficker Botnet

One year after the Conficker botnet was front-page news around the world, the U.S. Department of Homeland Security is preparing a report looking at the worldwide effort to keep it in check. The report, to be published within the month, shows how an ad hoc group of security researchers and Interne...

Remember Aurora–and Other Botnets

Last night my attention was drawn to a couple of blog entries relating to Google and the attacks they fell victim to earlier this year. These attacks were eventually labeled as “Operation Aurora” by McAfee based upon the presence of the “aurora” keyword embedded within some of the malware. First...

MS Live CAPTCHAS Busted by PushDo Botnet

The prolific Pushdo spam botnet has found a new way to penetrate Microsoft’s Live.com by exploiting weaknesses in the audio captchas designed to prevent automated scripts from accessing the popular email service. Read the full article. The Register...

Researcher Who Helped Take Down Waledac Talks Crimeware

Thorsten Holz, researcher at Vienna University of Technology, whose team not only participated in the recent takedown of the Waledac botnet, but released an interesting paper earlier this year, summarizing their findings based on 33GB of crimeware data obtained from active campaigns talks to Danc...

What Researchers Are Gaining from Troyak's De-Peering

Over the past week, security researchers and vendors have been playing a cat-and-mouse game with a cybercrime-friendly ISP known as TROYAK-AS. The results so far? A series of attempts by the cybercriminals to restore access to their botnet, and an invaluable learning experience for the community,...

Mapping the Criminal-ISP Infrastructure

According to a report issued today, eight networks connect directly to the botnet-hosting ISP Troyak and four other upstream providers that “surround the malicious core,” and help to “mask the true malware-hosting armada and provide solid uptime to the malware servers” for ZeuS botnets, Gozi, and...

Waledac Botnet Now Completely Crippled, Experts Say

After Microsoft’s actions to take down the Waledac botnet last month, there was some question about whether the operation was much more than a grab for headlines that would have little effect on actual spam levels or malware infections. But more than three weeks after the takedown, researchers sa...

ZeuS Botnet Module Gives Total PC Control

New capabilities are strengthening the ZeuS botnet, which criminals use to steal financial credentials and execute unauthorized transactions in online banking, automated clearing house ACH networks and payroll systems. The latest version of this cybercrime toolkit offers a $10,000 module that can...

Is That a Bot In Your Pocket? Or Does It Just Look Like One?

Last week at the RSA Conference, my colleague Derek Brown and I, presented findings from a research project titled MOBOTS: Pocketful of Pwnage, which was designed to show how easy it would be to create a large mobile botnet. Please note that we did not actually create a botnet; we simply presente...

Vodafone-Distributed Handset Found Pre-installed With Mariposa Bot

Security researchers have found the Mariposa bot client pre-installed on a mobile phone handset distributed in Europe, and say that the malware looks to have been installed on the phone’s memory card. The phone, the HTC Magic, runs the Google Android mobile operating system, and is a low-priced...

RSA 2010: Researchers Demo Mobile Botnet from Smartphone App

A pair of researchers has amassed nearly 8,000 iPhones and Android smartphones in an experimental mobile botnet that demonstrates the ease of spreading potentially malicious applications on these devices. Read the full article. Dark Reading...

RSA 2010: BlackEnergy 2 Botnet Revealed

Like the sequel to a successful movie, the botnet behind the distributed denial of service attacks that hit the country of Georgia during its conflict with Russia in 2008 has been updated. This time though, the idea isn’t hacktivism—it’s stealing financial data and, unlike in the case of other...

To Catch a Botnet: How Mariposa Was Busted

More details follow the news of the Spanish botnet Mariposa and its owners being caught. The Mariposa Working Group infiltrated the command-and-control structure of Mariposa to monitor the communication channels that relayed information from compromised systems back to the hackers who run the...

Mariposa Botnet Caught and Killed

Authorities have smashed one of the world’s biggest networks of virus-infected computers known as the Mariposa botnet, a data vacuum that stole credit cards and online banking credentials from as many as 12.7 million poisoned PCs. Read the full article. Associated Press...

Honeypots Threatened By Zombies

Innovations in botnet technology threaten the usefulness of honeypots, one of the main ways to study how bot herders control networks of zombie PCs. Computer scientists led by Cliff Zou and colleagues at the University of Central Florida warn that bot herders can now avoid honeypots – unprotected...

T.J. Campana on the Waledac Botnet Takedown

Dennis Fisher and Ryan Naraine talk with Microsoft’s T.J. Campana about the company’s work to disrupt and take down the Waledac botnet and the other work being done by Microsoft’s Digital Crimes Unit. Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground podcast on...