Home Security Mastermind of massive botnet caught because of basic mistake

Mastermind of massive botnet caught because of basic mistake

A Belarusian man who is said to be behind many of the biggest botnets has been caught, with investigators tracking him down because he used the ICQ number as a primary contact on both public and private websites.

Sergey Jarets, who was behind the Andromeda botnet (also called Gamarue) that used Windows machines, was arrested after an effort by law enforcement in many countries, and also Microsoft.

The Andromeda botnet had 464 separate botnets that spread malware from more than 80 families for the last six years.

Microsoft said that its analysis of more than 44,000 malware samples had indicated that 1214 domains were used by the botnet which utilised command and control centres around the world.

The security firm Recorded Future said in a blog post that the man who had been arrested was known as Ar3s.

andromeda one

Sergey Jarets' ​work​​station​ ​at​ ​the​ ​time​ ​of​ ​his​ ​arrest.

"Ar3s is the mastermind behind the Andromeda Trojan and a longstanding administrator of the Damage Lab hacking forum, the company's researchers Andrei Barysevich and Alexandr Solad wrote.

"With a high degree of confidence, we assess that the arrested person is likely Jarets Sergey Grigorevich, although the name was not revealed by the Belarusian authorities."

Barysevich and Solad said that undercover FBI agents had ascertained the connection between Jarets and the Andromeda botnet by purchasing malware from him.

Jarets had been a respected member of the Russian-speaking underground community since at least 2004, they said, adding that he was known to have authored the Windows SMTP Bruter, an SMTP brute-forcing tool and also Swf-Inj Service which hijacked Web traffic by embedding iFrame malware into SWF (small web format) files.

The Belarusian hacker earned US$500 for each copy of Andromeda and US$10 for follow-up malware updates. The two Recorded Future researchers said the last time that Jarets had been noticed on the DaMaGeLaB forum, the community where messages were exchanged, was on 22 November, indicating that he may have been arrested on this day.

Barysevich and Solad said since following Jarets, "we learned that Ar3s has used the ICQ number '5777677' as one of his primary contact methods, which was connected to the Internet user 'Sergey Jaretz' (very similar to the Russian spelling “Арес” and conformable with Jaretz/Ярец), who was also registered on multiple white-hacker and tech-oriented forums since the mid-2000s.

"Once we had a possible name, we conducted subsequent contact analysis based on 'Sergey Jaretz' and this ICQ number. We discovered that the phone number of the Belarussian mobile carrier MTC (+375) 29-735-56-11 tied him with an individual in Rechica, Belarus named Sergey Jarets or Jaretz (in Russian: Сергей Григорьевич Ярец), a person working at OJSC 'Televid' Tele-Radio Company, broadcasting throughout Rechitsa area, Gomel Region, Belarus."

Photo: courtesy Belarussian Government

LEARN HOW TO BE A SUCCESSFUL MVNO

Did you know: 1 in 10 mobile services in Australia use an MVNO, as more consumers are turning away from the big 3 providers?

The Australian mobile landscape is changing, and you can take advantage of it.

Any business can grow its brand (and revenue) by adding mobile services to their product range.

From telcos to supermarkets, see who’s found success and learn how they did it in the free report ‘Rise of the MVNOs’.

This free report shows you how to become a successful MVNO:

· Track recent MVNO market trends
· See who’s found success with mobile
· Find out the secret to how they did it
· Learn how to launch your own MVNO service

DOWNLOAD NOW!

Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.