Ex-anti-virus tech flogged MacDefender malware

Powered by SC Magazine
 

Botnet bloodbath continues.

A former information security engineer had operated the Kelihos botnet, the primary distribution system for the MacDefender malware, Microsoft says.

Microsoft alleged Andrey Sabelnikov, a Russian citizen and former security vendor staffer, was responsible operations of the botnet.

The Redmond giant took down Kelihos in September.

Microsoft Digital Crimes Unit senior attorney Richard Boscovich said it presented to court evidence that Sabelnikov wrote the code for and either created, or participated in creating, the Kelihos malware.

“Further, the complaint alleges that he used the malware to control, operate, maintain and grow the Kelihos botnet. These allegations are based on evidence Microsoft investigators uncovered while analysing the Kelihos malware," Boscovich said.

Microsoft alleged Sabelnikov registered more than 3,700 cz.cc subdomains from Dominique Alexander Piatti and dotFREE Group SRO, and used them to operate Kelihos.

Charges against against Alexander PiattiPiatti and dotFREE Group were settled and dismissed last year. 

It was also revealed that Sabelnikov worked as a software engineer and project manager at Russian anti-virus firm Agnitum, a provider of firewalls, anti-virus and security software.

Microsoft doesn't specify where Sabelnikov worked, but security blogger Brian Krebs pointed out that Sabelnikov's LinkedIn page said he worked at the company from 2005 to 2007.

Krebs said that Sabelnikov's alleged role was discovered after a security researcher obtained a copy of the source code to Kelihos, who noticed it contained debug code that downloaded a Kelihos malware installer from the domain sabelnikov.net, a photography site registered to Sabelnikov's name.

That site currently links to Sabelnikov's profile page at Russian social networking site Vkontakte.ru, which includes the same pictures found in the LinkedIn profile.

Despite the takedown, Boscovich said that thousands of computers remain infected and that the case "is not over".

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, UK edition


Ex-anti-virus tech flogged MacDefender malware
 
 
 
Top Stories
Business-focused Windows 10 brings back the Start menu
Microsoft skips 9 for the "greatest enterprise platform ever".
 
Feeling Shellshocked?
Stay up to date with patching for the Bash bug.
 
Amazon forced to reboot EC2 to patch Xen bug
Rolling restarts over next week.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Constantly rushing to the printer to stop other people seeing your printouts?
Sep 24, 2014
Lexmark's latest family of small-business printers include a feature that lets you stop anyone ...
This 4G smartphone costs $219
Sep 3, 2014
It's possible to spend a lot less on a smartphone if you're prepared to go with a brand you ...
Looking for storage? Seagate has five new small business NAS devices
Aug 22, 2014
Seagate has announced a new portfolio of Networked Attached Storage (NAS) solutions specifically ...
Run a small business in western Sydney?
Aug 15, 2014
This event might be of interest if you're looking to meet other people with a similar interest ...
Buying a tablet? Microsoft's Surface Pro 3 goes on sale this month
Aug 8, 2014
Microsoft has announced its Surface Pro 3 will go on sale in Australia on 28 August from ...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  66%
 
Advanced persistent threats
  4%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  12%
TOTAL VOTES: 1371

Vote