Microsoft disrupts ZeroAccess web fraud botnet
Infected computers dupe online advertisers by
generating fraudulent ad clicks
ZeroAccess, one of the world's
largest botnets - a network of computers infected with malware to trigger online
fraud - has been disrupted by Microsoft and law enforcement agencies.
ZeroAccess hijacks web search results and redirects users to potentially dangerous sites to steal their details.
It also generates fraudulent ad clicks on infected computers then claims payouts from duped advertisers.
Also called Sirefef botnet, ZeroAccess, has infected two million computers.
The botnet targets search results on Google, Bing and Yahoo search engines and is estimated to cost online advertisers $2.7m (£1.7m) per month.
Microsoft said it had been authorised by US regulators to "block incoming and outgoing communications between computers located in the US and the 18 identified Internet Protocol (IP) addresses being used to commit the fraudulent schemes".
“Start Quote
End Quote MicrosoftDue to its botnet architecture, ZeroAccess is one of the most robust and durable botnets in operation today and was built to be resilient to disruption efforts”
In addition, the firm has also taken control of 49
domains associated with ZeroAccess.
David Finn, executive director of Microsoft Digital Crimes Unit, said the disruption "will stop victims' computers from being used for fraud and help us identify the computers that need to be cleaned of the infection".
'Most robust'
The ZeroAccess botnet relies on waves of communication between groups of infected computers, instead of being controlled by a few servers.
This allows cyber criminals to control the botnet remotely from a range of computers, making it difficult to tackle.
According to Microsoft, more than 800,000 ZeroAccess-infected computers were active on the internet on any given day as of October this year.
"Due to its botnet architecture, ZeroAccess is one of the most robust and durable botnets in operation today and was built to be resilient to disruption efforts," Microsoft said.
However, the firm said its latest action is "expected to significantly disrupt the botnet's operation, increasing the cost and risk for cyber criminals to continue doing business and preventing victims' computers from committing fraudulent schemes".
Microsoft said its Digital Crimes Unit collaborated with the US Federal Bureau of Investigation (FBI) and Europol's European Cybercrime Centre (EC3) to disrupt the operations.
Earlier this year, security firm Symantec said it had disabled nearly 500,000 computers infected by ZeroAccess and taken them out of the botnet.
