Zeus' coffin not yet closed as domains still live

By Dan Kaplan on Apr 5, 2012 7:52 AM
Filed under Cloud

Three to go.

Three command-and-control (C&C) servers, which are feeding instructions to computers infected with the Zeus trojan, still are operational despite a Microsoft-led effort to disable the botnet, according to researchers at security firm FireEye.

Late last month, US Marshals led the raid on two hosting locations in the US, where they confiscated C&C servers and took down two key IP addresses in the process. In addition, as a result of the seizure, Microsoft assumed control of some 800 domains involved with the servers, a process known as sinkholing.

Atif Mushtaq, a senior staff scientist at FireEye, said in a blog post this week that the company has tracked more than 150 domains used by the botnet. But researchers found that despite the dismantling, three domains associated with Zeus remain live.

Botnets sometimes are able to stay alive by hiding behind fast-flux, or constantly changing, domains, but Mushtaq seems perplexed as to exactly why these three have been so resilient.

"[Microsoft's] main concern should be the three active domains," Mushtaq wrote. "Without these domains completely destroyed, this botnet can not be officially declared as dead."

A Microsoft spokeswoman did not immediately respond to a request for comment.

This article originally appeared at scmagazineus.com

 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, US edition

Zeus' coffin not yet closed as domains still live
Tags
 
 
 
 
 
Top Stories
Melbourne IT gunning for Bulletproof with top AWS honour
Lands elite status with cloud giant.
 
Samsung's Acer raid pays off with VicGov win
South Korean vendor scores place on $65m panel.
 
Potential burn hazard sees Toshiba recall power cords
Follows major recall of power cords by HP in US.
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
What would help your business most?


Latest Comments
CRN Magazine

Issue: 333 | November 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.