Task force silences massive Andromeda botnet

The botnet is thought to have spewed malware from two million infected devices

A massive botnet responsible for spreading malware using a two million-strong army of infected devices has finally been taken down by a joint task force of police agencies and private companies.

Thought to have been one of the largest ever discovered, the Andromeda botnet has been associated with 80 different malware families, and in the last six months alone, was detected or blocked on an average of one million devices every month.

The botnet was stopped by a joint task force comprising agents from the FBI, Europol's European Cybercrime Centre (EC3), Eurojust, the Joint Cybercrime Action Task Force (J-CAT), and a number of private organisations, including Microsoft.

Praising the cooperation between private and public organisations, Steven Wilson, head of EC3, said: "This is another example of international law enforcement working together with industry partners to tackle the most significant cyber criminals and the dedicated infrastructure they use to distribute malware on a global scale.

"The clear message is that public-private partnerships can impact these criminals and make the internet safer for all of us.

The Andromeda botnet is also thought to have been deployed by the now infamous Avalanche malware network, which was used to spread Trojans to German speakers in Germany, Austria and Switzerland in an attempt to extort money. That network was eventually taken down by the Luneburg Police in cooperation with the FBI, Eurojust, and Europol in late 2016.

Insights gained during the Avalanche investigation by local police agencies in Germany were instrumental in dismantling the Andromeda botnet, according to Europol. More than 1,500 domains carrying the Andromeda malware were subject to "sinkholing", a technique that redirects traffic between infected devices to servers controlled by the investigators.

Microsoft found that during a 48-hour sinkholing window, around two million unique Andromeda IP addresses were logged from 223 different countries, including the UK, France, Belgium, Italy, Spain, and non-EU states such as Australia, Canada and Singapore.

The investigation has led to the arrest of an individual in Belarus, but information on the suspect hasn't been released.

While the closure of the botnet is a significant victory for law enforcement agencies and those working to curb the effect of the highly lucrative malware industry, the threat has not been entirely removed.

Although the Avalanche network has now been down for almost a year, it's thought that as many as 55% of those devices originally infected are still infected today. It's likely that the residual effects of the Andromeda botnet will still be felt for some years to come.

There's also the issue of the remaining botnets still out there, including the recently discovered Reaper network, which managed to infect up to 10,000 devices in a single day.

Security researchers have also attempted to curb the spread of the infamous Mirai botnet, following a successful attack on the Dyn server network last year, and a 54-hour DDoS storm against a US college in March, however efforts to introduce a software fix for IoT devices have so far failed. 

Image: Bigstock

Featured Resources

Seven steps to connect and empower your frontline workers

How business leaders can improve communication with a secure platform

Free download

Create what’s next

The future of collaboration and productivity

Free Download

Leveraging the cloud without relinquishing control

Your data. Their cloud.

Free download

Re-architecting for nonstop innovation

Unlocking productivity, scalability, and lower costs for cloud natives

Free Download

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

Looking beyond the obvious: What’s best for multi-cloud?
Sponsored

Looking beyond the obvious: What’s best for multi-cloud?

8 Nov 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

12 Nov 2021
How to speed up Microsoft's Windows 11
Microsoft Windows

How to speed up Microsoft's Windows 11

9 Nov 2021