How a Security Industry Collective Shattered The Latest Hlux/Kelihos Botnet

On the heels of news earlier this week that Microsoft led an operation that resulted in the takedown of several Zeus botnets, on Wednesday more news came from the security industry on the successful takedown of yet another large botnet.

On Wednesday, experts from Kaspersky Lab along with others including experts from newly formedsecurity firm CrowdStrike, Dell SecureWorks and members of the Honeynet Project, announced the successful takedown of the second Hlux/Kelihos botnet. (Microsoft refers to the botnet as Kelihos, while Kaspersky calls it the Hlux botnet.)

Kaspersky Lab: Duqu Framework Likely Written in an Unknown Programming Language

Kaspersky Lab Researchers Say Parts of Duqu Are Written in an Unknown Programming Language, Uses Asynchronous Commutations

Duqu, sometimes referred to as “Son of Stuxnet”, surfaced in October 2010 and has been the subject of considerable industry research as experts attempt to unveil more details on the mystery and origin of the malware. Duqu was designed to help attackers infiltrate systems via backdoor access and steal information and data primarily from industrial control systems and corporate secrets. In other words, the ultimate cyber-espionage weapon.

Variant of Zeusbot/Spyeye Botnet uses p2p network model

 

Cybercriminals are using a modified version of the Zeusbot/Spyeye, which is using a peer-to-peer (P2P) network architecture, rather than a simple bot to command-and-control (C&C) server system, making the botnet much harder to take down, Symantec warned. ZeuS is very popular in the cybercriminal world because it’s capable of stealing a wide variety of information, documents and login credentials from infected systems.