Zeus' coffin not yet closed as domains still live

By Dan Kaplan on Apr 5, 2012 7:52 AM
Filed under Cloud

Three to go.

Three command-and-control (C&C) servers, which are feeding instructions to computers infected with the Zeus trojan, still are operational despite a Microsoft-led effort to disable the botnet, according to researchers at security firm FireEye.

Late last month, US Marshals led the raid on two hosting locations in the US, where they confiscated C&C servers and took down two key IP addresses in the process. In addition, as a result of the seizure, Microsoft assumed control of some 800 domains involved with the servers, a process known as sinkholing.

Atif Mushtaq, a senior staff scientist at FireEye, said in a blog post this week that the company has tracked more than 150 domains used by the botnet. But researchers found that despite the dismantling, three domains associated with Zeus remain live.

Botnets sometimes are able to stay alive by hiding behind fast-flux, or constantly changing, domains, but Mushtaq seems perplexed as to exactly why these three have been so resilient.

"[Microsoft's] main concern should be the three active domains," Mushtaq wrote. "Without these domains completely destroyed, this botnet can not be officially declared as dead."

A Microsoft spokeswoman did not immediately respond to a request for comment.

This article originally appeared at scmagazineus.com

 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, US edition

Zeus' coffin not yet closed as domains still live
Tags
 
 
 
 
 
Top Stories
PC repair firms in limbo as receivers take over NCSS
Buyer sought for failed computer repair group.
 
Microsoft cloud, apps and BI partners score awards double
High-performing Australian resellers celebrated.
 
Azure Australia is up and running
Microsoft's public cloud plan ramps up.
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
My business strategy is to:

Latest Comments
CRN Magazine

Issue: 330 | August 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.