ZeroAccess takedown leads hackers to abandon bot

Microsoft is claiming a total victory—at least for this round—over the ZeroAccess bot-herders whose criminal network was the target of a joint effort among Microsoft, the FBI, Europol, and a group of security vendors.

”I am pleased to report that our disruption effort has been successful, and it appears that the criminals have abandoned their botnet,” writes Richard Boscovich, assistant general counsel of Microsoft’s Digital Crimes Unit, in the Official Microsoft  Blog.

Bot-herders literally signaled their abandonment with a white flag. Part of a message sent to infected computers was “WHITEFLAG” and Boscovich said the team took the message as a victory ”which we believe symbolizes that the criminals have decided to surrender control of the botnet. Since that time, we have not seen any additional attempts by the bot-herders to release new code and as a result, the botnet is currently no longer being used to commit fraud.”

The company has also dropped its civil suit against the criminals (listed as John Does in court papers) in order to give law enforcement officials free rein to pursue them, Boscovich writes.

Significant distruption

Getting the bot-herders to walk away from their network wasn’t part of the plan two weeks ago when the takedown was executed through a court order that allowed Microsoft to take control of domain names linked to the botnet and to block command and control traffic to infected computers. Similar actions were taken by Europol in five European countries.

At the time of the takedown, Microsoft said, “Microsoft and its partners do not expect to fully eliminate the ZeroAccess botnet due to the complexity of the threat. However, Microsoft expects that this action will significantly disrupt the botnet’s operation.”

Boscovich says that within 24 hours of the disruption, the bot-herders pushed new instructions to infected computers so they could continue their illegal work, but those messages were  traced to their source IP addresses, which were then shut down. The final messages sent to the zombie machines included the word WHITEFLAG, he says.

Microsoft says ZeroAccess, also known as Sirefef, disables security software that might be running on victim computers, making it difficult to get rid of. Microsoft offers help here.

This story, "ZeroAccess takedown leads hackers to abandon bot" was originally published by Network World.

To comment on this article and other PCWorld content, visit our Facebook page or our Twitter feed.
Shop Tech Products at Amazon
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.