Home Security Mastermind of massive botnet caught because of basic mistake
Mastermind of massive botnet caught because of basic mistake Featured

A Belarusian man who is said to be behind many of the biggest botnets has been caught, with investigators tracking him down because he used the ICQ number as a primary contact on both public and private websites.

Sergey Jarets, who was behind the Andromeda botnet (also called Gamarue) that used Windows machines, was arrested after an effort by law enforcement in many countries, and also Microsoft.

The Andromeda botnet had 464 separate botnets that spread malware from more than 80 families for the last six years.

Microsoft said that its analysis of more than 44,000 malware samples had indicated that 1214 domains were used by the botnet which utilised command and control centres around the world.

The security firm Recorded Future said in a blog post that the man who had been arrested was known as Ar3s.

andromeda one

Sergey Jarets' ​work​​station​ ​at​ ​the​ ​time​ ​of​ ​his​ ​arrest.

"Ar3s is the mastermind behind the Andromeda Trojan and a longstanding administrator of the Damage Lab hacking forum, the company's researchers Andrei Barysevich and Alexandr Solad wrote.

"With a high degree of confidence, we assess that the arrested person is likely Jarets Sergey Grigorevich, although the name was not revealed by the Belarusian authorities."

Barysevich and Solad said that undercover FBI agents had ascertained the connection between Jarets and the Andromeda botnet by purchasing malware from him.

Jarets had been a respected member of the Russian-speaking underground community since at least 2004, they said, adding that he was known to have authored the Windows SMTP Bruter, an SMTP brute-forcing tool and also Swf-Inj Service which hijacked Web traffic by embedding iFrame malware into SWF (small web format) files.

The Belarusian hacker earned US$500 for each copy of Andromeda and US$10 for follow-up malware updates. The two Recorded Future researchers said the last time that Jarets had been noticed on the DaMaGeLaB forum, the community where messages were exchanged, was on 22 November, indicating that he may have been arrested on this day.

Barysevich and Solad said since following Jarets, "we learned that Ar3s has used the ICQ number '5777677' as one of his primary contact methods, which was connected to the Internet user 'Sergey Jaretz' (very similar to the Russian spelling “Арес” and conformable with Jaretz/Ярец), who was also registered on multiple white-hacker and tech-oriented forums since the mid-2000s.

"Once we had a possible name, we conducted subsequent contact analysis based on 'Sergey Jaretz' and this ICQ number. We discovered that the phone number of the Belarussian mobile carrier MTC (+375) 29-735-56-11 tied him with an individual in Rechica, Belarus named Sergey Jarets or Jaretz (in Russian: Сергей Григорьевич Ярец), a person working at OJSC 'Televid' Tele-Radio Company, broadcasting throughout Rechitsa area, Gomel Region, Belarus."

Photo: courtesy Belarussian Government


With 4 keynotes + 33 talks + 10 in-depth workshops from world-class speakers, YOW! is your chance to learn more about the latest software trends, practices and technologies and interact with many of the people who created them.

Speakers this year include Anita Sengupta (Rocket Scientist and Sr. VP Engineering at Hyperloop One), Brendan Gregg (Sr. Performance Architect Netflix), Jessica Kerr (Developer, Speaker, Writer and Lead Engineer at Atomist) and Kent Beck (Author Extreme Programming, Test Driven Development).

YOW! 2018 is a great place to network with the best and brightest software developers in Australia. You’ll be amazed by the great ideas (and perhaps great talent) you’ll take back to the office!

Register now for YOW! Conference

· Sydney 29-30 November
· Brisbane 3-4 December
· Melbourne 6-7 December

Register now for YOW! Workshops

· Sydney 27-28 November
· Melbourne 4-5 December



Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

· How does business security get breached?
· What can it cost to get it wrong?
· 6 actionable tips


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the sitecame into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.


Popular News




Sponsored News