The Necurs Botnet, one of the world’s largest malicious architectures, used to spread dreaded threats, appears to have vanished as of June 1
In the past few months, there has been much information regarding the activities of one of the largest botnets in the wild, apparetnly used by cybercriminals to deliver the Dridex banking malware and the dreaded Locky ransomware, but now many security experts wonder about its status.
The botnet used to spread the dreaded threats appears to have vanished; security experts from FireEye have observed a drastic drop in the malicious traffic linked to the botnet activity since June 1.
“We can only tell that the Dridex and Locky spam campaigns stopped since June 1 in our observation. We cannot confirm how the botnet was brought down yet,” Joonho Sa, a researcher for FireEye, confirmed to Motherboard.
When it was first spotted in 2015, experts classified the malicious infrastructure used to spread the threat as high-complex and efficient, “a masterpiece of criminality.”
In October 2015, an international joint effort of law enforcement agencies, including the FBI and the NCA, destroyed the botnet, but was resurrected and used mainly mainly spread the Locky ransomware. Experts called it Necurs and confirmed it was the world’s largest botnet.
Now experts have confirmed a decrease in its activities.
“We’ve seen a huge decrease in malicious traffic since. Locky has completely disappeared”
Necurs was the world’s largest botnet. If you saw most malicious traffic drop off your firewall 1st June… pic.twitter.com/cFX8ZiQjly
— Kevin Beaumont (@GossiTheDog) 6 giugno 2016
Necurs was used mainly to deliver the Locky ransomware, and its inactivity could be the evidence that the gangs behind the threat stopped working. This means that it is also reportedly impossible for victims to rescue their files by paying a ransom.
One hypothesis is that the 50 members of the Russian gang arrested by the Russian FSB security service on June 1 are the same operators behind the Necurs botnet.
“Russia’s FSB security service said on Wednesday it had helped detain a gang of about 50 hackers who stole over 1.7 billion roubles ($25.33 million) from the accounts of various Russian financial institutions,” reported the Reuters Agency.
The Motherboard also reported comments by experts from the Russian cybersecurity firm Group-IB that considers the arrests not linked to the activity of the Necurs Botnet.
(Security Affairs – Necurs Botnet, cybercrime)
Share On
