Microsoft Teams Up To Disrupt Insidious ZLoader Botnet
-
Loading... - Rubi Marshall
- 14 Apr 2022
- 320 Views
- 0 Like
- 0 Comment
The ZLoader malware first started popping up for sale on underground forums three years ago and it’s been terrorizing systems ever since. Thanks to the efforts of Microsoft, Palo Alto Networks, Avast, ESET and Black Lotus Labs, Zloader’s crime spree may now have come to an end.
Microsoft announced today that its Digital Crimes Unit (DCU) had orchestrated the seizure of numerous domain names that were used to control ZLoader. Slovakia-based ESET helped Microsoft identify several of those domains.
The court order Microsoft obtained named 384 domains in total — 65 core domains used for command and control of the malware and another 319 that ZLoader created using a domain generating algorithm (DGA).
Malware like ZLoader uses DGA to automatically create additional domain names that will be used as backup communication channels. Microsoft hopes that its effort to proactively ban future domains will make it more difficult for ZLoader’s operators to keep the botnet going.
Microsoft took one other step to give the ZLoader crew pause: it named Denis Malikov, a resident of Crimea, as one of the coders behind the malware. “We chose to name an individual in connection with this case to make clear that cybercriminals will not be allowed to hide behind the anonymity of the internet to commit their crimes,” said Microsoft.
What Is ZLoader?
When it was first released, ZLoader was primarily a banking Trojan. It could steal usernames, passwords and other information linked to numerous online banking sites around the globe.
It also had the ability to disable many popular antivirus tools, which allowed it to persist on infected systems. As time went on, ZLoader’s creators began offering it as malware-as-a-service to anyone willing to pay the price. Read More…
