Microsoft attempts takedown of global criminal botnet

Microsoft attempts takedown of global criminal botnet

Microsoft announced legal action Monday seeking to disrupt a major cybercrime digital network that uses more than 1 million zombie computers to loot bank accounts and spread ransomware, which experts consider a major threat to the U.S. presidential election.

The operation to knock offline command-and-control servers for a global botnet that uses an infrastructure known as Trickbot to infect computers with malware was initiated with an order that Microsoft obtained in Virginia federal court on Oct. 6. Microsoft argued that the crime network is abusing its trademark.

“It is very hard to tell how effective it will be but we are confident it will have a very long-lasting effect,” said Jean-Ian Boutin, head of threat research at ESET, one of several cybersecurity firms that partnered with Microsoft to map the command-and-control servers. “We’re sure that they are going to notice and it will be hard for them to get back to the state that the botnet was in.”

Cybersecurity experts said that Microsoft’s use of a U.S. court order to persuade internet providers to take down the botnet servers is laudable. But they add that it’s not apt to be successful because too many won’t comply and because Trickbot’s operators have a decentralized fall-back system and employ encrypted routing.

Paul Vixie of Farsight Security said via email “experience tells me it won’t scale — there are too many IP’s behind unco-operative national borders.” And the cybersecurity firm Intel 471 reported no significant hit on Trickbot operations Monday and predicted ”little medium- to long-term impact” in a report shared with The Associated Press.

But ransomware expert Brett Callow of the cybersecurity firm Emsisoft said that a temporary Trickbot disruption could, at least during the election, limit attacks and prevent the activation of ransomware on systems already infected.

The announcement follows a Washington Post report Friday of a major — but ultimately unsuccessful — effort by the U.S. military’s Cyber Command to dismantle Trickbot beginning last month with direct attacks rather than asking providers to deny hosting to domains used by command-and-control servers.

A U.S. policy called “persistent engagement” authorizes U.S. cyberwarriors to engage hostile hackers in cyberspace and disrupt their operations with code, something Cybercom did against Russian misinformation jockeys during U.S. midterm elections in 2018.

Created in 2016 and used by a loose consortium of Russian-speaking cybercriminals, Trickbot is a digital superstructure for sowing malware in the computers of unwitting individuals and websites. In recent months, its operators have been increasingly renting it out to other criminals who have used it to sow ransomware, which encrypts data on target networks, crippling them until the victims pay up.

One of the biggest reported victims of a ransomware variety sowed by Trickbot called Ryuk was the hospital chain Universal Health Services, which said all 250 of its U.S. facilities were hobbled in an attack last month that forced doctors and nurses to resort to paper and pencil.

U.S. Department of Homeland Security officials list ransomware as a major threat to the Nov. 3 presidential election. They fear an attack could freeze up state or local voter registration systems, disrupting voting, or knock out result-reporting websites.

While cybersecurity experts say the operators of Trickbot and affiliated digital crime syndicates are Russian speakers mostly based in eastern Europe, they caution that they are motivated by profit, not politics. They do, however, operate with impunity with no interference from the Kremlin as long as their targets are abroad.

Trickbot is a particularly robust internet nuisance. Called “malware-as-a-service,” its modular architecture lets it be used as a delivery mechanism for a wide array of criminal activity. It began mostly as a so-called banking Trojan that attempts to steal credentials from online bank account so criminals can fraudulently transfer cash.

But recently, researchers have noted a rise in Trickbot’s use in ransomware attacks targeting everything from municipal and state governments to school districts and hospitals. Ryuk and another type of ransomware called Conti — also distributed via Trickbot — dominated attacks on the U.S. public sector in September, said Callow of Emsisoft.

Alex Holden, founder of Milwaukee-based Hold Security, tracks Trickbot’s operators closely and said the reported Cybercom disruption — involving efforts to confuse its configuration through code injections — succeeded in temporarily breaking down communications between command-and-control servers and most of the bots.

“But that’s hardly a decisive victory,” he said, adding that the botnet rebounded with new victims and ransomware.

The disruption — in two waves that began Sept. 22 — was first reported by cybersecurity journalist Brian Krebs.

The AP could not immediately confirm the reported Cybercom involvement.

Frank Bajak, The Associated Press

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Alberta Premier Jason Kenney arrives for an announcement at a news conference in Calgary, Alta., Tuesday, Sept. 15, 2020. THE CANADIAN PRESS/Todd Korol
Inquiry into oil and gas foes to deliver report next year: Kenney

CALGARY — An inquiry into who is funding environmental opposition to the… Continue reading

Whatever snow may possibly fall in Red Deer on the weekend will melt when it hits the warm ground, says meteorologist Kyle Fougere with Environment and Climate Change Canada. (File photo by ADVOCATE staff)
Weather expected to get warmer next week in Red Deer

It’s going to be a cold weekend, according to Environment Canada. Saturday… Continue reading

Retired city manager Craig Curtis will argue for keeping the Molly Banister Drive right-of-way at Tuesday's public hearing. He warns of future gridlock if the extension is removed by city council. (Photo by Sean McIntosh/Advocate staff)
Former Red Deer city manager warns killing the Molly Banister Drive extension is ‘a terrible mistake’

Craig Curtis will argue for keeping the road alignment at next week’s public hearing

Alberta has 3,651 active cases of COVID-19. (File photo)
432 new COVID cases sets another record Friday

Central zone holds steady at 126 active cases

B.C. Liberal leader Andrew Wilkinson, B.C. NDP leader John Horgan and B.C. Greens leader Sonia Furstenau. (Black Press Media)
VIDEO: One day until B.C. voters go to the polls in snap election defined by pandemic

NDP Leader John Horgan’s decision to call an election comes more than a year ahead of schedule and during a pandemic

Alice Kolisnyk, deputy director of the Red Deer Food Bank, says the agency expects an increase in demand as the COVID-19 pandemic continues. Every new subscription to the Red Deer Advocate includes a $50 donation to the food bank. (Photo by BYRON HACKETT/Advocate Staff)
Support the food bank with a subscription to the Red Deer Advocate

The community’s most vulnerable members are always in need of a hand,… Continue reading

Canada's Chief Public Health Officer Theresa Tam responds to a question during a news conference Friday October 23, 2020 in Ottawa. Canada's top physician says she fears the number of COVID-19 hospitalizations and deaths may increase in the coming weeks as the second wave continues to drive the death toll toward 10,000. THE CANADIAN PRESS/Adrian Wyld
Top doctor warns severe illness likely to rise, trailing spike in COVID-19 cases

Canada’s top physician painted a bleak picture Saturday of the toll the… Continue reading

Conservative Leader Erin O'Toole holds a press conference on Parliament Hill in Ottawa Wednesday, Sept. 2, 2020. Conservative Leader Erin O'Toole is naming his shadow cabinet, including his predecessor Andrew Scheer as the party's infrastructure critic. THE CANADIAN PRESS/Sean Kilpatrick
O’Toole tells Alberta UCP AGM Liberals were “late and confused” on COVID response

Conservative Leader Erin O’Toole says Alberta has responded to the COVID-19 pandemic… Continue reading

Indigenous fishermen carry lobster traps in Saulnierville, N.S. on Wednesday, Oct. 21, 2020. THE CANADIAN PRESS /Andrew Vaughan
Federal representative hopes to ease tensions in Nova Scotia lobster dispute

HALIFAX — The man tasked with lowering the temperature in a heated… Continue reading

A voter places her absentee ballot in the ballot box, Wednesday, Oct. 7, 2020, at Merrill Auditorium in Portland, Maine. THE CANADIAN PRESS/AP/Robert F. Bukaty
American voters living in Canada increasingly being counted in presidential race

The largest number of Canadian-based American voters cast their ballots in New York and California

This photo provided by Air Force Reserve shows a sky view of Hurricane Epsilon taken by Air Force Reserve hurricane hunter team over the Atlantic Ocean taken Wednesday, Oct. 21, 2020.   Epsilon’s maximum sustained winds have dropped slightly as it prepares to sideswipe Bermuda on a path over the Atlantic Ocean.  The National Hurricane Center says it should come close enough Thursday, Oct. 22, evening to merit a tropical storm warning for the island.  (Air Force Reserve via AP)
Hurricane Epsilon expected to remain offshore but will push waves at Atlantic Canada

Epsilon is not expected to have any real impact on land

A composite image of three photographs shows BC NDP Leader John Horgan, left, in Coquitlam, B.C., on Sept. 25, 2020; BC Green Party Leader Sonia Furstenau, centre, in Victoria on Sept. 24, 2020; and BC Liberal Party Leader Andrew Wilkinson Pitt Meadows, B.C., on Sept. 24, 2020. THE CANADIAN PRESS/Darryl Dyck, Chad Hipolito
British Columbia votes in snap election called during COVID-19 pandemic

NDP Leader John Horgan called the snap election one year before the fixed voting date

Nunavut's provincial flag flies on a flag pole in Ottawa, on Tuesday June 30, 2020. The annual report from Nunavut's representative for children and youth says "complacency and a lack of accountability" in the territory's public service means basic information about young people needing services isn’t tracked. THE CANADIAN PRESS/Adrian Wyld
Nunavut’s young people ‘should be expecting more’ from government services: advocate

‘The majority of information we requested is not tracked or was not provided by departments’

Most Read