跳到主体内容

Kaspersky Lab joins forces with INTERPOL, Industry and Law Enforcement Partners to Disrupt Simda Botnet

2015年4月14日

In a global operation coordinated by the INTERPOL Global Complex for Innovation in Singapore, a group of leading IT companies including Kaspersky Lab, Microsoft, Trend Micro and Japan’s Cyber Defense Institute, in collaboration with law enforcement agencies, have disrupted the Simda criminal botnet – a network of thousands of infected PCs around the world

In a global operation coordinated by the INTERPOL Global Complex for Innovation in Singapore, a group of leading IT companies including Kaspersky Lab, Microsoft, Trend Micro and Japan’s Cyber Defense Institute, in collaboration with law enforcement agencies, have disrupted the Simda criminal botnet – a network of thousands of infected PCs around the world.

In a series of simultaneous actions on Thursday 9 April, 10 command and control servers were seized in the Netherlands, with additional servers taken down in the US, Russia, Luxembourg and Poland. The operation involved officers from the Dutch National High Tech Crime Unit (NHTCU) in the Netherlands, the Federal Bureau of Investigation (FBI) in the US, the Police Grand-Ducale Section Nouvelles Technologies in Luxembourg, and the Russian Ministry of the Interior’s Cybercrime Department “K” supported by the INTERPOL National Central Bureau in Moscow.

This is expected to significantly disrupt the botnet’s operation. It will increase the cost and risk for cybercriminals intent on continuing their illegal business and will prevent victims’ computers from participating in malicious schemes.

  • Simda is a “pay-per-install” malware used to distribute illicit software and different types of malware, including those capable of stealing financial credentials. The pay-per-install model allows cybercriminals to earn money by selling access to infected PCs to other criminals who then install additional programs on it.
  • Simda is distributed by a number of infected websites redirecting to exploit kits. The attackers compromise legitimate web sites/servers so that the web pages served to visitors include malicious code. When users browse these pages, the malicious code silently loads content from the exploit site and infects a non-updated PC.
  • The Simda botnet has been seen in more than 190 countries, with the US, UK, Russia, Canada and Turkey being the worst affected.
  • The bot believed to have infected 770, 000 computers worldwide, with the vast majority of victims located in the US (more than 90,000 new infections since the start of 2015).
  • Active for years, Simda had been increasingly refined to exploit any vulnerability, with new, harder to detect versions being generated and distributed every few hours. At the moment, Kaspersky Lab’s virus collection contains more than 260,000 executable files belonging to different versions of Simda malware.

Information and intelligence is now being gathered in order to identify the actors behind the Simda botnet; the people who applied to their criminal activities the business model of charging affiliate partners.

“This successful operation highlights the value of, and need for partnerships involving national and international law enforcement and private industry in the fight against the global threat of cybercrime,” said Sanjay Virmani, Director of the INTERPOL Digital Crime Centre.  “The operation has dealt a significant blow to the Simda botnet.  INTERPOL will continue its work to assist member countries in protecting their citizens from cybercriminals and to identify other emerging threats.”

“Botnets are geographically distributed networks and it is usually a challenging task to take down such a thing. That’s why the collaborative effort of both private and public sectors is crucial here – every party makes its own important contribution to the joint project. In this case, Kaspersky Lab’s role was to provide technical analysis of the bot, collect botnet telemetry from the Kaspersky Security Network and advise on takedown strategies,” added Vitaly Kamluk, Principal Security Researcher at Kaspersky Lab, and currently on secondment to INTERPOL.

As a result of the disruption operation, command and control servers used by criminals to communicate with infected machines have been shut down. However it’s important to note that some infections are still in place. In order to help victims to disinfect their PCs, Kaspersky Lab has created a special CheckIP website. Here, users can find out if their IPs have been spotted on Simda command and control servers, signifying the possibility of active or past infection. These IP addresses became available as a result of the server takedown operation.

If a user’s IP is recognized, it doesn't necessarily mean that the system is infected – in some cases one IP address might be used by several PCs on the same network (for example, they could be connected to one Internet service provider). However it makes sense to double-check and scan the system with a comprehensive security solution, including the free Kaspersky Security Scan or a trial version of Kaspersky Internet Security.

To check if your system is a part of a Simda botnet go to https://checkip.kaspersky.com

To learn more about Simda botnet disruption go to Securelist.com

Kaspersky Lab joins forces with INTERPOL, Industry and Law Enforcement Partners to Disrupt Simda Botnet

In a global operation coordinated by the INTERPOL Global Complex for Innovation in Singapore, a group of leading IT companies including Kaspersky Lab, Microsoft, Trend Micro and Japan’s Cyber Defense Institute, in collaboration with law enforcement agencies, have disrupted the Simda criminal botnet – a network of thousands of infected PCs around the world
Kaspersky logo

关于卡巴斯基

卡巴斯基是一家成立于1997年的全球网络安全和数字隐私公司。卡巴斯基不断将深度威胁情报和安全技术转化成创新的安全解决方案和服务,为全球的企业、关键基础设施、政府和消费者提供安全保护。公司提供全面的安全产品组合,包括领先的端点保护解决方案以及多种针对性的安全解决方案和服务,以及用于应对复杂和不断变化的数字威胁的网络免疫解决方案。全球有超过4亿用户使用卡巴斯基技术保护自己,我们还帮助全球200,000家企业客户保护最重要的东西。要了解更多详情,请访问www.kaspersky.com.cn.

相关文章 企业新闻