Avalanche malware network taken down by security consortium

International law enforcement agencies, prosecutors, security and IT organisations buddy up to squash cybercriminal infrastructure

botnet

The Avalanche malware network has been taken down by a group of organisations and companies who uncovered where it was being hosted, Symantec has revealed.

The consortium seized 39 command and control (C&C) servers and "several hundred thousand" domains where at least 17 malware families were being hosted.

The seeds of the investigation were sown more than four years ago, when the company was researching so-called law enforcement ransomware, the most prevalant type of malware at the time, which extorts money from victims by pretending to be a message from an organisation like the FBI.

During its investigation, which was published in a 2012 paper, Symantec discovered two ransomware trojans, Trojan.Ransomlock.P and Trojan.Bebloh, were targeting German speakers in Germany, Austria, and Switzerland. The company joined forces with police in the German town of Luneberg and the Public Prosecutor's Office from the German town of Verden, the company was able to help them get further in their enquiries by reverse engineering malware and identifying malicious infrastructure.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

During these tests, Symantec discovered new malware families that were using the same C&C servers, which allowed Luneberg Police to start casting the net wider.

All the malware families were then discovered to be part of the Avalanche botnet, a collection of computers that are rented out to help actors target victims using the C&C architecture.

Other organisations, including the BSI, FKIE, BFK and other law enforcement agencies joined the search to find the root of the network.

On 30 November, the investigations ended and the group not only confiscated the servers used to distribute malware, it also arrested multiple key people alleged to be part of the malware ring.

"The Luneberg police and the Verden Public Prosecutor's Office investigation is a prime example of how the dogged persistence of a team of experienced law enforcement investigators, combined with assistance from government, academia, and private industry, can result in highly-effective action against cybercriminals," Symantec said.

"Symantec was pleased to have been able to assist in this work, and is ready to provide technical assistance to law enforcement as required in future investigations."

Featured Resources

How inkjet can transform your business

Get more out of your business by investing in the right printing technology

Download now

Journey to a modern workplace with Office 365: which tools and when?

A guide to how Office 365 builds a modern workplace

Download now

Modernise and transform your sales organisation

Learn how a modernised sales process can drive your business

Download now

Your guide to managing cloud transformation risk

Realise the benefits. Mitigate the risks

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/operating-systems/microsoft-windows/354789/microsoft-pulls-disastrous-windows-10-security-update
Microsoft Windows

Microsoft pulls disastrous Windows 10 security update

17 Feb 2020
Visit/operating-systems/27717/how-to-fix-a-stuck-windows-10-update
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020
Visit/cloud/cloud-computing/354767/google-cloud-snaps-up-multi-cloud-analytics-platform-for-26bn
cloud computing

Google Cloud snaps up multi-cloud analytics platform for $2.6bn

13 Feb 2020