Microsoft and partners disrupt Zeus botnets<p>We have discussed in the past our collaboration with external parties to combat botnet threats to further the betterment of the Internet, such as Operations <a href="http://blogs.technet.com/b/microsoft_blog/archive/2010/02/25/cracking-down-on-botnets.aspx">b49</a>, <a href="http://blogs.technet.com/b/microsoft_blog/archive/2011/09/22/rustock-civil-case-closed-microsoft-refers-criminal-evidence-to-fbi.aspx">b107</a> and <a href="http://blogs.technet.com/b/microsoft_blog/archive/2011/09/27/microsoft-neutralizes-kelihos-botnet-names-defendant-in-case.aspx">b79</a>. This week, Microsoft has partnered with security experts and the financial services industry on a new action codenamed <a href="http://blogs.technet.com/b/microsoft_blog/archive/2012/03/25/microsoft-and-financial-services-industry-leaders-target-cybercriminal-operations-from-zeus-botnets.aspx">Operation b71</a> to disrupt some of the worst known botnets using variants of the notorious Zeus malware (which we detect as <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fZbot">Win32/Zbot</a>). </p>
<p>Due to the complexities of these targets, unlike Microsoft’s prior botnet operations, the goal of this action was not the permanent shutdown of all impacted Zeus botnets. However, this action is expected to significantly impact the cybercriminals’ operations and infrastructure, advance global efforts to help victims regain control of their infected computers and also help further investigations against those responsible for the threat.</p>
<p>The Zbot /Zeus threat has targeted the financial sector for quite some time. We documented the threat in detail in a special Security Intelligence Report <a href="http://download.microsoft.com/download/A/2/2/A226868B-7922-4655-BF48-F11DDEE3E63C/Battling the Zbot threat.pdf">whitepaper</a> published in 2010.</p>
<p>Millions of dollars of fraud are a result of this family of threat and it has taken cross-industry collaboration to take effective action against it. Microsoft has partnered with <a href="http://www.fsisac.com/">FS-ISAC</a>, <a href="https://www.nacha.org/">NACHA</a>, <a href="http://www.kyrus-tech.com/">Kyrus Tech</a>, <a href="http://www.f-secure.com/">F-Secure</a> and others to disrupt a large portion of the command and control infrastructure of various botnets using <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fZbot">Zbot</a>, <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fEyeStye">Spyeye</a> and Ice IX variants of the Zeus family of malware. More information about this operation can be found here: <a href="http://blogs.technet.com/b/microsoft_blog/archive/2012/03/25/microsoft-and-financial-services-industry-leaders-target-cybercriminal-operations-from-zeus-botnets.aspx">http://blogs.technet.com/b/microsoft_blog/archive/2012/03/25/microsoft-and-financial-services-industry-leaders-target-cybercriminal-operations-from-zeus-botnets.aspx</a></p>
<p>The Microsoft Malware Protection Center (MMPC) is proud to have supported this action, which represents the fourth operation of <a href="http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/botnet.aspx">Project MARS</a> - a component of Microsoft’s End-to-End Trust initiative. Project MARS is a joint effort between the Microsoft Digital Crimes Unit, MMPC, Microsoft Support and the Trustworthy Computing team to annihilate botnets and help make the Internet safer for everyone. </p>
<p>MMPC is committed to partnering across the industry to help disrupt threats to the Internet and our customers. We will have more to share on Project MARS and related operations as we move forward. </p>
<p>--<em>Jeff Williams, Principal Group Program Manager</em></p><div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3488510" width="1" height="1">
Source:
Microsoft and partners disrupt Zeus botnets
