Microsoft attempts takedown of global criminal botnet

Microsoft attempts takedown of global criminal botnet

Microsoft announced legal action Monday seeking to disrupt a major cybercrime digital network that uses more than 1 million zombie computers to loot bank accounts and spread ransomware, which experts consider a major threat to the U.S. presidential election.

The operation to knock offline command-and-control servers for a global botnet that uses an infrastructure known as Trickbot to infect computers with malware was initiated with an order that Microsoft obtained in Virginia federal court on Oct. 6. Microsoft argued that the crime network is abusing its trademark.

“It is very hard to tell how effective it will be but we are confident it will have a very long-lasting effect,” said Jean-Ian Boutin, head of threat research at ESET, one of several cybersecurity firms that partnered with Microsoft to map the command-and-control servers. “We’re sure that they are going to notice and it will be hard for them to get back to the state that the botnet was in.”

Cybersecurity experts said that Microsoft’s use of a U.S. court order to persuade internet providers to take down the botnet servers is laudable. But they add that it’s not apt to be successful because too many won’t comply and because Trickbot’s operators have a decentralized fall-back system and employ encrypted routing.

Paul Vixie of Farsight Security said via email “experience tells me it won’t scale — there are too many IP’s behind unco-operative national borders.” And the cybersecurity firm Intel 471 reported no significant hit on Trickbot operations Monday and predicted ”little medium- to long-term impact” in a report shared with The Associated Press.

But ransomware expert Brett Callow of the cybersecurity firm Emsisoft said that a temporary Trickbot disruption could, at least during the election, limit attacks and prevent the activation of ransomware on systems already infected.

The announcement follows a Washington Post report Friday of a major — but ultimately unsuccessful — effort by the U.S. military’s Cyber Command to dismantle Trickbot beginning last month with direct attacks rather than asking providers to deny hosting to domains used by command-and-control servers.

A U.S. policy called “persistent engagement” authorizes U.S. cyberwarriors to engage hostile hackers in cyberspace and disrupt their operations with code, something Cybercom did against Russian misinformation jockeys during U.S. midterm elections in 2018.

Created in 2016 and used by a loose consortium of Russian-speaking cybercriminals, Trickbot is a digital superstructure for sowing malware in the computers of unwitting individuals and websites. In recent months, its operators have been increasingly renting it out to other criminals who have used it to sow ransomware, which encrypts data on target networks, crippling them until the victims pay up.

One of the biggest reported victims of a ransomware variety sowed by Trickbot called Ryuk was the hospital chain Universal Health Services, which said all 250 of its U.S. facilities were hobbled in an attack last month that forced doctors and nurses to resort to paper and pencil.

U.S. Department of Homeland Security officials list ransomware as a major threat to the Nov. 3 presidential election. They fear an attack could freeze up state or local voter registration systems, disrupting voting, or knock out result-reporting websites.

While cybersecurity experts say the operators of Trickbot and affiliated digital crime syndicates are Russian speakers mostly based in eastern Europe, they caution that they are motivated by profit, not politics. They do, however, operate with impunity with no interference from the Kremlin as long as their targets are abroad.

Trickbot is a particularly robust internet nuisance. Called “malware-as-a-service,” its modular architecture lets it be used as a delivery mechanism for a wide array of criminal activity. It began mostly as a so-called banking Trojan that attempts to steal credentials from online bank account so criminals can fraudulently transfer cash.

But recently, researchers have noted a rise in Trickbot’s use in ransomware attacks targeting everything from municipal and state governments to school districts and hospitals. Ryuk and another type of ransomware called Conti — also distributed via Trickbot — dominated attacks on the U.S. public sector in September, said Callow of Emsisoft.

Alex Holden, founder of Milwaukee-based Hold Security, tracks Trickbot’s operators closely and said the reported Cybercom disruption — involving efforts to confuse its configuration through code injections — succeeded in temporarily breaking down communications between command-and-control servers and most of the bots.

“But that’s hardly a decisive victory,” he said, adding that the botnet rebounded with new victims and ransomware.

The disruption — in two waves that began Sept. 22 — was first reported by cybersecurity journalist Brian Krebs.

The AP could not immediately confirm the reported Cybercom involvement.

Frank Bajak, The Associated Press

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Don and Gloria Moore, of Red Deer, are set to celebrate their 70th anniversary later this month. (Contributed photo)
Red Deer couple to celebrate 70th anniversary

Red Deer couple Don and Gloria Moore are set to celebrate their… Continue reading

Chris Scott, owner of The Whistle Stop Cafe, was put in handcuffs after an anti-restriction protest Saturday in the parking lot of the business. (Screenshot via The Whistle Stop Facebook page)
UPDATE: Central Alberta cafe owner arrested after anti-restriction protest

The owner of a central Alberta cafe, which was the site of… Continue reading

Alberta has 1,910 active cases of COVID-19 as of Wednesday. Red Deer is reporting five active cases, with 108 recovered. (File photo)
Red Deer now has 911 active COVID-19 cases

Central zone has 2,917 active cases

Red Deer Regional Hospital Centre's expansion project is still a high priority, says Alberta Infrastructure Minister Prasad Panda. (File photo by Advocate staff)
Red Deer hospital ICU admissions stable, but rising, says surgeon

The Red Deer Regional Hospital Centre’s intensive care unit is in better… Continue reading

FILE - A firefighter wears a mask as he drives his truck. THE CANADIAN PRESS/Jonathan Hayward, File
VIDEO: Flames rip through Edmonton-area seniors complex, but no fatalities

ST. ALBERT, Alta. — Fire has destroyed part of a retirement complex… Continue reading

Nuns of Mother Teresa’s Missionaries of Charity, carry some of her relics during a vigil of prayer in preparation for the canonization of Mother Teresa in the St. John in Latheran Basilica at the Vatican, Friday, Sept. 2, 2016. In which city did she do much of her charitable work? (AP Photo/Gregorio Borgia)
QUIZ: How much do you know about these motherhood issues?

In honour of Mother’s Day, take this 10-question quiz

Dr. Robert Strang, Nova Scotia's chief medical officer of health, is setting off a social media reaction with his calls to stop non essential shopping, such as "buying sandals at Costco", with this photo of his worn sandals, which he published to social media on Saturday, May 8, 2021. THE CANADIAN PRESS/HO-Dr. Robert Strang, *MANDATORY CREDIT*
Nova Scotia’s top doctor sparks meme with caution on non-essential shopping

HALIFAX — Nova Scotia’s top doctor has launched a social media meme… Continue reading

Chief Public Health Officer Theresa Tam speaks during a technical briefing on the COVID pandemic in Canada, in Ottawa on Friday, Jan. 15, 2021. Canada's chief public health officer is reminding Canadians even those who are fully vaccinated are not immune from transmitting the COVID-19. THE CANADIAN PRESS/Adrian Wyld
Tam warns that full vaccination does not equal full protection from COVID-19

Canada’s chief public health officer reminded Canadians on Saturday that even those… Continue reading

Carolina Hurricanes coach Rod Brind'Amour conducts drills during NHL hockey training camp in Morrisville, N.C., Wednesday, Jan. 6, 2021. (AP Photo/Gerry Broome)
NHL relaxing virus protocols for vaccinated playoff teams

The NHL is relaxing virus protocols for teams that reach a threshold… Continue reading

Canada skip Kerri Einarson directs her teammates against Sweden in a qualification game at the Women's World Curling Championship in Calgary, Alta., Saturday, May 8, 2021. THE CANADIAN PRESS/Jeff McIntosh
Canada’s Einarson eliminated at curling worlds after 8-3 loss to Sweden’s Hasselborg

CALGARY — Canada’s Kerri Einarson was eliminated at the world women’s curling… Continue reading

Jennifer Coffman, owner of Truffle Pigs in Field, B.C., poses beside her business sign on Thursday, May 6, 2021, in this handout photo. Her restaurant and lodge have been hit hard by a closure of a section of the Trans-Canada Highway and by the British Columbia government discouraging Alberta residents from visiting during the pandemic. THE CANADIAN PRESS/HO-Jennifer Coffman, *MANDATORY CREDIT*
‘Why we survive’: B.C. boundary towns struggle without Albertans during pandemic

Jennifer Coffman didn’t expect to get hit with a double whammy at… Continue reading

A courtroom at the Edmonton Law Courts building, in Edmonton on Friday, June 28, 2019. The effect of the coronavirus pandemic will have a lasting impact on the Canadian justice system warn a number of legal experts. The Alberta Court of Queen's Bench announced Sunday it would adjourn all scheduled trials across the province for at least 10-weeks limiting hearings to only emergency or urgent matters. THE CANADIAN PRESS/Jason Franson
Edmonton mother found guilty of manslaughter in death of five-year-old girl

EDMONTON — An Edmonton woman was found guilty Friday of manslaughter in… Continue reading

A Statistics Canada 2016 Census mailer sits on the key board of a laptop after arriving in the mail at a residence in Ottawa, May 2, 2016. THE CANADIAN PRESS/Sean Kilpatrick
Statistics Canada sees more demand to fill out census online during pandemic

OTTAWA — Statistics Canada says the response to the census is higher… Continue reading

Most Read