Ex-anti-virus tech flogged MacDefender malware

Powered by SC Magazine
 

Botnet bloodbath continues.

A former information security engineer had operated the Kelihos botnet, the primary distribution system for the MacDefender malware, Microsoft says.

Microsoft alleged Andrey Sabelnikov, a Russian citizen and former security vendor staffer, was responsible operations of the botnet.

The Redmond giant took down Kelihos in September.

Microsoft Digital Crimes Unit senior attorney Richard Boscovich said it presented to court evidence that Sabelnikov wrote the code for and either created, or participated in creating, the Kelihos malware.

“Further, the complaint alleges that he used the malware to control, operate, maintain and grow the Kelihos botnet. These allegations are based on evidence Microsoft investigators uncovered while analysing the Kelihos malware," Boscovich said.

Microsoft alleged Sabelnikov registered more than 3,700 cz.cc subdomains from Dominique Alexander Piatti and dotFREE Group SRO, and used them to operate Kelihos.

Charges against against Alexander PiattiPiatti and dotFREE Group were settled and dismissed last year. 

It was also revealed that Sabelnikov worked as a software engineer and project manager at Russian anti-virus firm Agnitum, a provider of firewalls, anti-virus and security software.

Microsoft doesn't specify where Sabelnikov worked, but security blogger Brian Krebs pointed out that Sabelnikov's LinkedIn page said he worked at the company from 2005 to 2007.

Krebs said that Sabelnikov's alleged role was discovered after a security researcher obtained a copy of the source code to Kelihos, who noticed it contained debug code that downloaded a Kelihos malware installer from the domain sabelnikov.net, a photography site registered to Sabelnikov's name.

That site currently links to Sabelnikov's profile page at Russian social networking site Vkontakte.ru, which includes the same pictures found in the LinkedIn profile.

Despite the takedown, Boscovich said that thousands of computers remain infected and that the case "is not over".

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, UK edition


Ex-anti-virus tech flogged MacDefender malware
 
 
 
Top Stories
Is your lawyer smarter than IBM's Watson?
Sparke Helmore CIO Peter Campbell expects machine learning to take a chunk out of law firm profits. But he’s far from downcast.
 
Australia passes data retention into law
Mammoth last-ditch effort by Greens, indies knocked back.
 
Turnbull introduces bill to block piracy websites
Takes ownership of legislation from Brandis.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Xero now includes an inventory function built-in
Mar 26, 2015
Xero has added inventory and other major new features to the latest release of its cloud ...
Apple reveals its new MacBook
Mar 13, 2015
Replacing the MacBook Air as Apple's thinnest laptop, the new MacBook comes packed with features.
Xero has released a new version of its app for the iPad
Mar 6, 2015
iPad-wielding Xero users can now take advantage of a new version of the iOS app for the cloud ...
Microsoft is offering Azure for Disaster Recovery to Australian SMBs
Feb 10, 2015
If you haven't talked to your IT provider about disaster recovery, it might be worth discussing ...
The 2015 Xero Roadshow is on: here are the locations and dates
Feb 6, 2015
The 2015 Xero Roadshow kicked off this week - see where you can attend at locations around ...
Latest Comments
Polls
Do you support the Government's data retention scheme?

   |   View results
Yes
  9%
 
No
  91%
TOTAL VOTES: 1394

Vote