ZeroAccess botnet earns $100k a day

Research has revealed a two year old botnet has infected more than a million machines and can generate up to $100,000 a day for its operators.

The ZeroAccess botnet had about half of its infected machines located in the US which were compromised after victims visited malicious webpages.

Sophos researchers watched the botnet for up to four years and said in a report (pdf) that it generated cash through click fraud and bitcoin mining.

Senior security adviser Chester Wisniewski said the botnet had targeted more affulent countries.

“If you target Americans, you're going to get a lot more bitcoins,” Wisniewski said.

ZeroAccess owners had disguised bot traffic to resemble ordinary traffic, making it difficult to pinpoint the location of the command-and-control server.

Other botnets could be identified by watching for traffic such as bogus online gaming and random page visits.

“It wouldn't look any different than someone looking at their stock portfolio,” Wisniewski said.

“We don't know which of the million is controlling it because it's blending in with the others. There are a million connections coming into the cloud and one of the million is the bad guy.”

This article originally appeared at scmagazineus.com