Microsoft’s Digital Crimes Unit (DCU) deactivated the infamous ZLoader cybercrime botnet that was utilized to send Ryuk ransomware in attacks on medical care providers. Microsoft lately secured a court order coming from the United States District Court for the Northern District of Georgia permitting the taking of 65 hard-coded websites the ZLoader botnet employs for command-and-control communications. Those domains were already sinkholed, blocking the botnet operator from conversing with devices corrupted with ZLoader malware.
ZLoader malware enclosed a domain generation algorithm (DGA) which is prompted whenever it’s impossible to connect with the hard-coded websites, which acts as a failsafe for any takedown campaigns. The court order likewise authorized Microsoft to take 319 DGA-registered domains. Microsoft is doing something to prevent the signing up of any other DGA domains.
ZLoader is included in a family of malware variants that originated from the ZeuS banking Trojan. At first, ZeuS was employed for credential and financial fraud, with the goal of moving funds from victims’ monetary accounts. The hacker responsible for the malware then organized a malware-as-a-service operation to transmit ransomware and malware to other threat actors including Ryuk.
Ryuk ransomware was widely utilized in attacks on the medical field since its rise in 2018, and ZLoader was one method of transmitting the ransomware. ZLoader can deactivate a widely used antivirus tool to avoid discovery, and the malware was used on many devices, which are primarily in healthcare and education.
The takedown of the botnet is considerable; nonetheless, the botnet operators are most likely already doing something to build another command and control infrastructure. Microsoft mentioned the seizure was successful and led to the non-permanent deactivation of the ZLoader system, which has made it more challenging for the organized criminal group to proceed with its malicious pursuits.
The case was referred to authorities, who are keeping track of this activity closely and will keep working with our partners to keep an eye on the actions of these threat actors. Microsoft will consult with internet service providers to distinguish and remediate affected individuals. Microsoft additionally established that it is set to take additional legal action and use technical options to take care of ZLoader and other botnets.
Microsoft furthermore named Denis Malikov, who lives in Simferopol on the Crimean Peninsula, as somebody who is thought to be liable for creating a part of the malware that was employed for sending ransomware. This implies that cybercriminals won’t be permitted to hide behind the anonymity of the web to commit their criminal activity.
Microsoft stated that the cybersecurity company ESET, Black Lotus Labs, and Palo Alto Networks’ Unit 42 team helped with its inquiry of the ZLoader activities. The Health Information Sharing and Analysis Center (H-ISAC), the Microsoft Threat Intelligence Center, the Financial Services Information Sharing and Analysis Centers (FS-ISAC), and the Microsoft Defender Teamadditionally furnished supplemental information.
