Zotob Arrests Highlight Cybercrime Organization

The expanding investigation into this month's Zotob worm outbreak is uncovering evidence of the growing nexus between worm writers and gangs looking to profit from cybercrime, according to security experts.

The FBI this week confirmed that Turkish law enforcement officials are investigating 16 more suspects in connection with the Zotob worm and its variants.

This follows last week's arrests of Farid Essebar, an 18-year-old Moroccan believed to have been responsible for writing the Zotob and Mytob worms, and Atilla Ekici, a 21-year-old man from Turkey who apparently financed the effort.

According to an FBI spokesperson, the 16 individuals now being investigated are not believed to have any direct links to the actual creation and dissemination of the worms that hit several large organizations two weeks ago. Rather, "it looks more like they are associated with a credit card theft ring" possibly linked to the worms, he says.

The news is further evidence of the growing alliance between hackers and those seeking to profit from cybercrime, says Graham Cluley, a senior technology consultant at antivirus firm Sophos.

"It is certainly something that we thought has been happening for some time," Cluley says. "What you are likely to see here over the next few days is the unraveling of an entire identity fraud gang."

Searching for the Source

According to Cluley, Sophos researchers have discovered that at least 20 other worms and viruses--including multiple versions of Zotob and Mytob and a version of last year's prolific Mydoom worm--were created by Essebar. All of these worms and viruses include the Diabl0 handle that Essebar used as a code name, he says.

Malware such as Zotob and Mytob are used by hackers to download so-called bot programs that allow remote servers to take control of compromised systems and steal information from them. The communication between an infected system and remote server is often done using the Internet Relay Chat (IRC) messaging protocol.

Mytob variants created by Diabl0 communicated with a server apparently owned by a group called the 0x90-team whose Web site discussed hacker exploits and credit card fraud, says Ken Dunham, a senior engineer at VeriSign iDefense Intelligence in Reston, Virginia. The site, which is registered to an individual in Paris, runs several online forums on how to make money by selling, buying and trading such information, he says.

Diabl0 had his own private directory on the Web server hosting the site, which he used to download the various variants of Mytob and other worms that he created, Dunham says.

According to one source who asked not to be named, the server belonging to the 0x90-team is located in the U.S. And, according to antivirus firm F-Secure in Finland, the group's Web site has been used as an underground gathering site for bot authors for quite a while.

A code analysis of the Zotob.A worm and a couple of other variants shows that it was controlled by an IRC server named diabl0.turkcoders.net, Cluley says. The code contained a personal greeting to a person called Coder, which was the handle used by Ekici, the Turk arrested last week.

"That points to the guy in Turkey, who is alleged to have paid the worm author for writing Zotob," Cluley says.