BredoLab botnet

The BredoLab Botnet, also known by its alias Oficla,[1] was an Armenian[2] botnet mostly involved in viral e-mail spam. Before the botnet was eventually dismantled in November 2010 through the seizure of its command and control servers, it was estimated to consist of millions of zombie computers.[3][4][5]

Operations

Though the earliest reports surrounding the BredoLab botnet originate from May 2009 (when the first malware samples of the Bredolab trojan horse were found) the botnet itself did not rise to prominence until August 2009, when there was a major surge in the size of the botnet.[6][7] Bredonet's main form of propagation was through sending malicious e-mails that included malware attachments which would infect a computer when opened, effectively turning the computer into another zombie controlled by the botnet. At its peak, the botnet was capable of sending 3.6 billion viral emails every day.[8] The other main form of propagation was through the use of drive-by downloads - a method which exploits security vulnerabilities in software. This method allowed the botnet to bypass software protection in order to facilitate downloads without the user being aware of them.[9]

The main income of the botnet was generated through leasing parts of the botnet to third parties who could subsequently use these infected systems for their own purposes, and security researchers estimate that the owner of the botnet made up to $139,000 a month from botnet related activities.[4][10][11] Due to the rental business strategy, the payload of Bredolab has been very diverse, and ranged from scareware to malware and e-mail spam.[12]

Dismantling and aftermath

On 25 October 2010, a team of Dutch law enforcement agents seized control of 143 servers which contained three command & control servers, one database server and several management servers from the Bredolab botnet in a datacenter from LeaseWeb.,[13] effectively removing the botnet herder's ability to control the botnet centrally.[2][12][14] In an attempt to regain control over his botnet, the botnet herder utilized 220,000 computers which were still under his control, to unleash a DDoS attack on LeaseWeb servers, though these attempts were ultimately in vain.[15] After taking control over the botnet, the law enforcement team utilized the botnet itself to send a message to owners of infected computers, stating that their computer was part of the botnet.[8][16]

Subsequently Armenian law enforcement officers arrested an Armenian citizen, Georgy Avanesov,[4][17] on the basis of being the suspected mastermind behind the botnet. The suspect denied any such involvement in the botnet.[11][12] He was sentenced to four years in prison in May 2012.[18]

While the seizure of the command and control servers severely disrupted the botnet's ability to operate,[19] the botnet itself is still partially intact, with command and control servers persisting in Russia and Kazakhstan.[16] Security firm Fireeye believes that a secondary group of botnet herders has taken over the remaining part of the botnet for their own purposes, possibly a previous client who reverse engineered parts of the original botnet creator's code. Even so, the group noted that the botnet's size and capacity has been severely reduced by the law enforcement intervention.[10][13][20]

References

  1. ↑ Search the malware encyclopedia: Bredolab, Microsoft.com
  2. ↑ 2.0 2.1 Dan Raywood (2010-10-26). "Bredolab botnet taken down after Dutch intervention". SC Magazine UK. Retrieved 2012-01-28.
  3. ↑ James Wray and Ulf Stabe (2010-10-28). "Researchers: Bredolab still lurking, though severely injured (Update 3) - Security". Thetechherald.com. Retrieved 2012-01-28.
  4. ↑ 4.0 4.1 4.2 "Infosecurity (UK) - BredoLab downed botnet linked with Spamit.com". Infosecurity-magazine.com. 2010-11-01. Retrieved 2012-01-28.
  5. ↑ Help Net Security (2010-11-02). "The aftermath of the Bredolab botnet shutdown". Net-security.org. Retrieved 2012-01-28.
  6. ↑ "Security Threat Reports - Research Analysis - Trend Micro USA". Us.trendmicro.com. Retrieved 2012-01-28.
  7. ↑ "Trojan.Bredolab". Symantec. Retrieved 2012-01-28.
  8. ↑ 8.0 8.1 "Infosecurity (USA) - Dutch government shuts down Bredolab botnet". Infosecurity-us.com. 2010-10-26. Retrieved 2012-01-28.
  9. ↑ "Trojan.Bredolab Technical Details". Symantec. Retrieved 2012-01-28.
  10. ↑ 10.0 10.1 Bredolab Down but Far from Out After Botnet Takedown, 28 October 2010
  11. ↑ 11.0 11.1 "More Bredolab arrests may occur, say Dutch prosecutors - Techworld.com". News.techworld.com. Retrieved 2012-01-28.
  12. ↑ 12.0 12.1 12.2 Schwartz, Mathew J. (2010-10-29). "Bredolab Botnet Still Spewing Malware - Bredolab Botnet". InformationWeek. Retrieved 2012-01-28.
  13. ↑ 13.0 13.1 de Graaf, JD (2012). "BREDOLAB: Shopping in the Cybercrime Underworld". ICDF2C Conference (Springer-Verlag).
  14. ↑ Josh Halliday (2010-10-26). "Suspected Bredolab worm mastermind arrested in Armenia | Technology". London: guardian.co.uk. Retrieved 2012-01-28.
  15. ↑ "Suspected Bredolab Botnet Runner Arrested in Armenia - Softpedia". News.softpedia.com. 2010-10-26. Retrieved 2012-01-28.
  16. ↑ 16.0 16.1 Undead Bredolab zombie network lashes out from the grave, 29 October 2010
  17. ↑ "Bredolab Mastermind Was Key Spamit.com Affiliate — Krebs on Security". Krebsonsecurity.com. 2010-10-30. Retrieved 2012-01-28.
  18. ↑ "Russian spam mastermind jailed for creating botnet". BBC News. 24 May 2012. Retrieved 24 May 2012.
  19. ↑ "Bredolab, dead, dying or dormant? » CounterMeasures". Countermeasures.trendmicro.eu. 2010-10-26. Retrieved 2012-01-28.
  20. ↑ Atif Mushtaq on 2010.10.26 (2010-10-26). "FireEye Malware Intelligence Lab: Bredolab - Severely Injured but not dead". Blog.fireeye.com. Retrieved 2012-01-28.