Microsoft with CERT & NIXI burst world’s largest network of botnet

In a fight against world’s most prolific botnets — Necurs, which infected more than nine million computers globally, Microsoft and its partners across 35 countries have now taken coordinated legal and technical steps to disrupt it.

The announcement by the tech giant came after eight years of tracking and planning.

This disruption will help ensure the criminals behind this network are no longer able to use key elements of its infrastructure to execute cyberattacks. Necurs is believed to be operated by criminals based in Russia, Microsoft said on Tuesday.

What is botnet:

A botnet is a network of computers that a cybercriminal has infected with malicious software or malware.

Once infected, criminals can control those computers remotely and use them to commit crimes.

What is Necurs

Necurs was used for a wide range of crimes including pump-and-dump stock scams, fake pharmaceutical spam email and “Russian dating” scams.

It has also been used to attack other computers on the Internet, steal credentials for online accounts, and steal people’s personal information and confidential data.

Interestingly, it seems the criminals behind Necurs sell or rent access to the infected computer devices to other cybercriminals as part of a botnet-for-hire service.

Necurs is also known for distributing financially targeted malware and ransomware, cryptomining, and even has a DDoS (distributed denial of service) capability that has not yet been activated but could be at any moment.

Why was Necurs so dangerous:

Microsoft’s Digital Crimes Unit, BitSight and others in the security community first observed the Necurs botnet in 2012 and have seen it distribute several forms of malware, including the GameOver Zeus banking trojan.

The Necurs botnet is one of the largest networks in the spam email threat ecosystem, with victims in nearly every country in the world.

“During a 58-day period in our investigation, for example, we observed that one Necurs-infected computer sent a total of 3.8 million spam emails to over 40.6 million potential victims,” Tom Burt, Microsoft’s Corporate Vice President for Customer Security & Trust wrote in a blog post.

On March 5, the U.S. District Court for the Eastern District of New York issued an order enabling Microsoft to take control of U.S.-based infrastructure Necurs uses to distribute malware and infect victim computers.

“With this legal action and through a collaborative effort involving public-private partnerships around the globe, Microsoft is leading activities that will prevent the criminals behind Necurs from registering new domains to execute attacks in the future,” Burt said.

This was accomplished by analyzing a technique used by Necurs to systematically generate new domains through an algorithm.

“We were then able to accurately predict over six million unique domains that would be created in the next 25 months,” Burt said.

Impact on India

The network had affected a significant amount of devices in India as well. According to Microsoft’s report, among the list of countries affected by the network in March 2020 showed that 13.59 per cent of the distinct infected IP addresses were from India.

“India is also home to one of the largest number of super-nodes, also known as P2P (peer-to-peer) communication channels which is created by cybercriminals in order to prevent botnet disruption by law enforcement, network operators and researchers,” said the report.

The Microsoft Digital Crimes Unit partnered with the Computer Emergency Response Team (CERT-IN) and National Internet Exchange of India (NIXI) to disrupt cyberattacks led by the botnet in the country. This prevented future attacks by the people behind Necurs as it prevented the attackers from registering new domains.