Security Market Segment LS
Thursday, 07 December 2017 06:16

Mastermind of massive botnet caught because of basic mistake Featured


A Belarusian man who is said to be behind many of the biggest botnets has been caught, with investigators tracking him down because he used the ICQ number as a primary contact on both public and private websites.

Sergey Jarets, who was behind the Andromeda botnet (also called Gamarue) that used Windows machines, was arrested after an effort by law enforcement in many countries, and also Microsoft.

The Andromeda botnet had 464 separate botnets that spread malware from more than 80 families for the last six years.

Microsoft said that its analysis of more than 44,000 malware samples had indicated that 1214 domains were used by the botnet which utilised command and control centres around the world.

The security firm Recorded Future said in a blog post that the man who had been arrested was known as Ar3s.

andromeda one

Sergey Jarets' ​work​​station​ ​at​ ​the​ ​time​ ​of​ ​his​ ​arrest.

"Ar3s is the mastermind behind the Andromeda Trojan and a longstanding administrator of the Damage Lab hacking forum, the company's researchers Andrei Barysevich and Alexandr Solad wrote.

"With a high degree of confidence, we assess that the arrested person is likely Jarets Sergey Grigorevich, although the name was not revealed by the Belarusian authorities."

Barysevich and Solad said that undercover FBI agents had ascertained the connection between Jarets and the Andromeda botnet by purchasing malware from him.

Jarets had been a respected member of the Russian-speaking underground community since at least 2004, they said, adding that he was known to have authored the Windows SMTP Bruter, an SMTP brute-forcing tool and also Swf-Inj Service which hijacked Web traffic by embedding iFrame malware into SWF (small web format) files.

The Belarusian hacker earned US$500 for each copy of Andromeda and US$10 for follow-up malware updates. The two Recorded Future researchers said the last time that Jarets had been noticed on the DaMaGeLaB forum, the community where messages were exchanged, was on 22 November, indicating that he may have been arrested on this day.

Barysevich and Solad said since following Jarets, "we learned that Ar3s has used the ICQ number '5777677' as one of his primary contact methods, which was connected to the Internet user 'Sergey Jaretz' (very similar to the Russian spelling “Арес” and conformable with Jaretz/Ярец), who was also registered on multiple white-hacker and tech-oriented forums since the mid-2000s.

"Once we had a possible name, we conducted subsequent contact analysis based on 'Sergey Jaretz' and this ICQ number. We discovered that the phone number of the Belarussian mobile carrier MTC (+375) 29-735-56-11 tied him with an individual in Rechica, Belarus named Sergey Jarets or Jaretz (in Russian: Сергей Григорьевич Ярец), a person working at OJSC 'Televid' Tele-Radio Company, broadcasting throughout Rechitsa area, Gomel Region, Belarus."

Photo: courtesy Belarussian Government

WEBINAR event: IT Alerting Best Practices 27 MAY 2PM AEST

LogicMonitor, the cloud-based IT infrastructure monitoring and intelligence platform, is hosting an online event at 2PM on May 27th aimed at educating IT administrators, managers and leaders about IT and network alerts.

This free webinar will share best practices for setting network alerts, negating alert fatigue, optimising an alerting strategy and proactive monitoring.

The event will start at 2pm AEST. Topics will include:

- Setting alert routing and thresholds

- Avoiding alert and email overload

- Learning from missed alerts

- Managing downtime effectively

The webinar will run for approximately one hour. Recordings will be made available to anyone who registers but cannot make the live event.



Security requirements such as confidentiality, integrity and authentication have become mandatory in most industries.

Data encryption methods previously used only by military and intelligence services have become common practice in all data transfer networks across all platforms, in all industries where information is sensitive and vital (financial and government institutions, critical infrastructure, data centres, and service providers).

Get the full details on Layer-1 encryption solutions straight from PacketLight’s optical networks experts.

This white paper titled, “When 1% of the Light Equals 100% of the Information” is a must read for anyone within the fiber optics, cybersecurity or related industry sectors.

To access click Download here.


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments