Department of Justice shuts down Coreflood botnet

'Stop' command sent from replaced command and control servers.

Earlier this week the US Department of Justice (DoJ) obtained an unprecedented temporary restraining order (TRO) that effectively allowed it to send 'stop' commands from the command and control servers of the Coreflood botnet - thus managing to shut it down.

As is the case with most botnets, the controllers of Coreflood have the ability to remotely shut down botnet agents installed on the victims' computers. However, the botnet is quite old and does not possess several of the 'security' features seen in many newer botnets - where such remote commands need to be authenticated to ensure that they come from the botnet's controllers rather than anyone else - for example law enforcement agencies or competing botherders.

Of course, despite the botnet being taken down, computers are still infected with the Coreflood malware. However, at the moment the botherders have little to no ability to control these zombies, so it is a good time for security vendors and ISPs to ensure the malicious software is removed from the computers altogether. Microsoft has already shipped an update for users of the Malicious Software Removal Tool that removes Coreflood from the infected machines.

Coreflood has a long history, going back to at least 2002. In 2005 it made the news when Miami businessman Joe Lopez lost over US$90,000. The money had been wired out of his account to a bank in Latvia - his machine was found to be infected with the Coreflood trojan. Lopez sued his bank in the first of many lawsuits brought against banks by malware victims.

Last month's takedown of Rustock saw spam levels take a nose dive, but Coreflood appears to have been significantly less active in sending spam - since its takedown there have been no signs of any drop in spam levels.

Industry comments on the takedown can be found at Damballa's The Day Before Zero blog here and at Brian Krebs's security blog here, with a longer analysis on the blog of cybercrime expert Gary Warner on his blog here. The FBI press release concerning the case can be found here.

Posted on 15 April 2011 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

VB2015 paper: Sizing cybercrime: incidents and accidents, hints and allegations

Cybercrime is big. But how big is it really? In a paper presented at VB2015 and together with the presentation video published on our website today, ESET researcher Stephen Cobb looks at previous studies that attempt the size of cybercrime and asks…

Throwback Thursday: The Thin Blue Line

This Throwback Thursday, VB heads back to 1994 when UK Fraud Squad detectives started making inroads into the most puzzling 'Whodunnit' since the Great Train Robbery. Had an outbreak of computer crime swept Britain? No, it was all part of a police…

Welcome to virusbulletin.com

Almost 20 years after Virus Bulletin revealed its first site on the "world wide web", we've redesigned our whole website. And we have a new domain as well.

VB2015 video: TurlaSat: The Fault in our Stars

In a presentation at VB2015 in Prague, Kaspersky Lab researcher Kurt Baumgartner talked about Turla's extraplanetary activities: the malware used (and abused) satellite Internet connections for command and control communication.

Security vendors should embrace those hunting bugs in their products

When interviewed by the Risky Business podcast last week, VB Editor Martijn Grooten talked about the security of security products and said that many vendors are embracing the work done by Tavis Ormandy and others - as they should.