Task force silences massive Andromeda botnet

The botnet is thought to have spewed malware from two million infected devices

A massive botnet responsible for spreading malware using a two million-strong army of infected devices has finally been taken down by a joint task force of police agencies and private companies.

Thought to have been one of the largest ever discovered, the Andromeda botnet has been associated with 80 different malware families, and in the last six months alone, was detected or blocked on an average of one million devices every month.

The botnet was stopped by a joint task force comprising agents from the FBI, Europol's European Cybercrime Centre (EC3), Eurojust, the Joint Cybercrime Action Task Force (J-CAT), and a number of private organisations, including Microsoft.

Praising the cooperation between private and public organisations, Steven Wilson, head of EC3, said: "This is another example of international law enforcement working together with industry partners to tackle the most significant cyber criminals and the dedicated infrastructure they use to distribute malware on a global scale.

"The clear message is that public-private partnerships can impact these criminals and make the internet safer for all of us.

The Andromeda botnet is also thought to have been deployed by the now infamous Avalanche malware network, which was used to spread Trojans to German speakers in Germany, Austria and Switzerland in an attempt to extort money. That network was eventually taken down by the Luneburg Police in cooperation with the FBI, Eurojust, and Europol in late 2016.

Insights gained during the Avalanche investigation by local police agencies in Germany were instrumental in dismantling the Andromeda botnet, according to Europol. More than 1,500 domains carrying the Andromeda malware were subject to "sinkholing", a technique that redirects traffic between infected devices to servers controlled by the investigators.

Microsoft found that during a 48-hour sinkholing window, around two million unique Andromeda IP addresses were logged from 223 different countries, including the UK, France, Belgium, Italy, Spain, and non-EU states such as Australia, Canada and Singapore.

The investigation has led to the arrest of an individual in Belarus, but information on the suspect hasn't been released.

While the closure of the botnet is a significant victory for law enforcement agencies and those working to curb the effect of the highly lucrative malware industry, the threat has not been entirely removed.

Although the Avalanche network has now been down for almost a year, it's thought that as many as 55% of those devices originally infected are still infected today. It's likely that the residual effects of the Andromeda botnet will still be felt for some years to come.

There's also the issue of the remaining botnets still out there, including the recently discovered Reaper network, which managed to infect up to 10,000 devices in a single day.

Security researchers have also attempted to curb the spread of the infamous Mirai botnet, following a successful attack on the Dyn server network last year, and a 54-hour DDoS storm against a US college in March, however efforts to introduce a software fix for IoT devices have so far failed. 

Image: Bigstock

Featured Resources

Security analytics for your multi-cloud deployments

IBM Security QRadar SIEM solution brief

Download now

Five reasons to move to the cloud

Join the enterprises moving their workloads to the cloud

Download now

Architecting hybrid IT and edge for digital advantage

Why business leaders should consider a hybrid IT strategy

Download now

Six reasons to accelerate remote asset monitoring with AI

How to optimise resources, increase productivity, and grow profit margins with AI

Download now

Recommended

Lazarus APT hacking group is targeting the defense industry
Security

Lazarus APT hacking group is targeting the defense industry

26 Feb 2021
Microsoft open sources CodeQL queries used in Solorigate inquiry
Security

Microsoft open sources CodeQL queries used in Solorigate inquiry

26 Feb 2021
CISA warns of ongoing Accellion File Transfer Appliance attacks
hacking

CISA warns of ongoing Accellion File Transfer Appliance attacks

25 Feb 2021
What is a Trojan?
Security

What is a Trojan?

25 Feb 2021

Most Popular

How to build a CMS with React and Google Sheets
content management system (CMS)

How to build a CMS with React and Google Sheets

24 Feb 2021
Npower shuts down app after hackers steal user data
hacking

Npower shuts down app after hackers steal user data

25 Feb 2021
New monitors for an agile new normal
Sponsored

New monitors for an agile new normal

19 Feb 2021