Security News > 2010 > March > Researchers Map Multi-Network Cybercrime Infrastructure

http://www.krebsonsecurity.com/2010/03/researchers-map-multi-network-cybercrime-infrastructure/ By Brian Krebs Krebs on Security March 17th, 2010 Last week, security experts launched a sneak attack to disconnect Troyak, an Internet service provider in Eastern Europe that served as a global gateway to a nest of cyber crime activity. For the past seven days, unnamed members of the security community reportedly have been playing Whac-a-Mole with Troyak, which has bounced from one legitimate ISP to the next in a bid to reconnect to the wider Internet. But experts say Troyak's apparent hopscotching is expected behavior from what is in fact a carefully architected, round-robin network of backup and redundant carriers, all designed to keep a massive organized criminal operation online should a disaster like the Troyak disconnection strike. Security firm RSA believes Troyak is but one of five upstream providers that encircle a nest of eight so-called "bulletproof networks" - Web hosting providers considered impervious to takedown by local law enforcement (pictured in red in the graphic below). RSA said this group of eight hosts some of the Internet's largest concentrations of malicious software, including password stealing banking Trojans like ZeuS and Gozi, as well as huge repositories of personal and financial data stolen by these Trojans and a notorious Russian phishing operation known as RockPhish. [...] ___________________________________________________________ Register now for HITBSecConf2010 - Dubai, the premier deep-knowledge network security event in the GCC, featuring keynote speakers John Viega and Matt Watchinski! http://conference.hitb.org/hitbsecconf2010dxb/

News URL

http://www.krebsonsecurity.com/2010/03/researchers-map-multi-network-cybercrime-infrastructure/