Security Market Segment LS
Thursday, 07 December 2017 06:16

Mastermind of massive botnet caught because of basic mistake Featured

By

A Belarusian man who is said to be behind many of the biggest botnets has been caught, with investigators tracking him down because he used the ICQ number as a primary contact on both public and private websites.

Sergey Jarets, who was behind the Andromeda botnet (also called Gamarue) that used Windows machines, was arrested after an effort by law enforcement in many countries, and also Microsoft.

The Andromeda botnet had 464 separate botnets that spread malware from more than 80 families for the last six years.

Microsoft said that its analysis of more than 44,000 malware samples had indicated that 1214 domains were used by the botnet which utilised command and control centres around the world.

The security firm Recorded Future said in a blog post that the man who had been arrested was known as Ar3s.

andromeda one

Sergey Jarets' ​work​​station​ ​at​ ​the​ ​time​ ​of​ ​his​ ​arrest.

"Ar3s is the mastermind behind the Andromeda Trojan and a longstanding administrator of the Damage Lab hacking forum, the company's researchers Andrei Barysevich and Alexandr Solad wrote.

"With a high degree of confidence, we assess that the arrested person is likely Jarets Sergey Grigorevich, although the name was not revealed by the Belarusian authorities."

Barysevich and Solad said that undercover FBI agents had ascertained the connection between Jarets and the Andromeda botnet by purchasing malware from him.

Jarets had been a respected member of the Russian-speaking underground community since at least 2004, they said, adding that he was known to have authored the Windows SMTP Bruter, an SMTP brute-forcing tool and also Swf-Inj Service which hijacked Web traffic by embedding iFrame malware into SWF (small web format) files.

The Belarusian hacker earned US$500 for each copy of Andromeda and US$10 for follow-up malware updates. The two Recorded Future researchers said the last time that Jarets had been noticed on the DaMaGeLaB forum, the community where messages were exchanged, was on 22 November, indicating that he may have been arrested on this day.

Barysevich and Solad said since following Jarets, "we learned that Ar3s has used the ICQ number '5777677' as one of his primary contact methods, which was connected to the Internet user 'Sergey Jaretz' (very similar to the Russian spelling “Арес” and conformable with Jaretz/Ярец), who was also registered on multiple white-hacker and tech-oriented forums since the mid-2000s.

"Once we had a possible name, we conducted subsequent contact analysis based on 'Sergey Jaretz' and this ICQ number. We discovered that the phone number of the Belarussian mobile carrier MTC (+375) 29-735-56-11 tied him with an individual in Rechica, Belarus named Sergey Jarets or Jaretz (in Russian: Сергей Григорьевич Ярец), a person working at OJSC 'Televid' Tele-Radio Company, broadcasting throughout Rechitsa area, Gomel Region, Belarus."

Photo: courtesy Belarussian Government

NEW OFFER - ITWIRE LAUNCHES PROMOTIONAL NEWS & CONTENT

Recently iTWire remodelled and relaunched how we approach "Sponsored Content" and this is now referred to as "Promotional News and Content”.

This repositioning of our promotional stories has come about due to customer focus groups and their feedback from PR firms, bloggers and advertising firms.

Your Promotional story will be prominently displayed on the Home Page.

We will also provide you with a second post that will be displayed on every page on the right hand side for at least 6 weeks and also it will appear for 4 weeks in the newsletter every day that goes to 75,000 readers twice daily.

POST YOUR NEWS ON ITWIRE NOW!

MITIGATE FRAUD WITH HYLAND’S DIGITAL CREDENTIALING SOLUTION

Some of the most important records are paper-based documents that are slow to issue, easy to fake and expensive to verify.

Digital licenses and certificates, identity documents and private citizen immunity passports can help you deliver security and mobility for citizens’ information.

Join our webinar: Thursday 4th June 12 midday East Australian time

JOIN WEBINAR!

Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

VENDOR NEWS & WEBINARS

REVIEWS

Recent Comments