IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Task force silences massive Andromeda botnet

The botnet is thought to have spewed malware from two million infected devices

A massive botnet responsible for spreading malware using a two million-strong army of infected devices has finally been taken down by a joint task force of police agencies and private companies.

Thought to have been one of the largest ever discovered, the Andromeda botnet has been associated with 80 different malware families, and in the last six months alone, was detected or blocked on an average of one million devices every month.

The botnet was stopped by a joint task force comprising agents from the FBI, Europol's European Cybercrime Centre (EC3), Eurojust, the Joint Cybercrime Action Task Force (J-CAT), and a number of private organisations, including Microsoft.

Praising the cooperation between private and public organisations, Steven Wilson, head of EC3, said: "This is another example of international law enforcement working together with industry partners to tackle the most significant cyber criminals and the dedicated infrastructure they use to distribute malware on a global scale.

"The clear message is that public-private partnerships can impact these criminals and make the internet safer for all of us.

The Andromeda botnet is also thought to have been deployed by the now infamous Avalanche malware network, which was used to spread Trojans to German speakers in Germany, Austria and Switzerland in an attempt to extort money. That network was eventually taken down by the Luneburg Police in cooperation with the FBI, Eurojust, and Europol in late 2016.

Insights gained during the Avalanche investigation by local police agencies in Germany were instrumental in dismantling the Andromeda botnet, according to Europol. More than 1,500 domains carrying the Andromeda malware were subject to "sinkholing", a technique that redirects traffic between infected devices to servers controlled by the investigators.

Microsoft found that during a 48-hour sinkholing window, around two million unique Andromeda IP addresses were logged from 223 different countries, including the UK, France, Belgium, Italy, Spain, and non-EU states such as Australia, Canada and Singapore.

The investigation has led to the arrest of an individual in Belarus, but information on the suspect hasn't been released.

While the closure of the botnet is a significant victory for law enforcement agencies and those working to curb the effect of the highly lucrative malware industry, the threat has not been entirely removed.

Although the Avalanche network has now been down for almost a year, it's thought that as many as 55% of those devices originally infected are still infected today. It's likely that the residual effects of the Andromeda botnet will still be felt for some years to come.

There's also the issue of the remaining botnets still out there, including the recently discovered Reaper network, which managed to infect up to 10,000 devices in a single day.

Security researchers have also attempted to curb the spread of the infamous Mirai botnet, following a successful attack on the Dyn server network last year, and a 54-hour DDoS storm against a US college in March, however efforts to introduce a software fix for IoT devices have so far failed. 

Image: Bigstock

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Samsung proposes 11 Texas semiconductor plants worth $191 billion
Hardware

Samsung proposes 11 Texas semiconductor plants worth $191 billion

21 Jul 2022
Should you take your password manager off the internet?
Sponsored

Should you take your password manager off the internet?

28 Jul 2022