New details emerged about a botnet that has been around for a long time, and is still functioning and bringing in revenue.
Dutch-based security firm Fox-IT detailed in a report the identity of the people running the Pobelka botnet, and has described how it started and how it is still working.
The Pobelka botnet is just one of the many botnets currently operating in the Netherlands.
Its botmaster is targeting mostly Dutch and German users (but occasionally also those from Sweden, the U.S. and the United Arab Emirates), and is harvesting a wide array of information from their computers by infecting them with the Citadel banking and information-stealing Trojan.
Initially, the botmasters’ Trojan of choice was SpyEye, but he added Citadel to it around February 2012. He also started his attacks with a server-based attack kit researchers called “Bentpanel,” then switched to using the Blackhole exploit kit to deliver the malware.
While analyzing Bentpanel’s backend, they concluded the botmaster uses the online name of “Finist.” The panel also contained the botmasters jabber address where he received notifications from the panel.
The researchers believe Finist sells the stolen information to the highest bidder, and occasionally uses stolen banking information to steal money. At one time, Finist even employed money mules to get to the money he transferred to accounts set up specifically for this purpose.
“The Pobelka botnet is just one of the many examples of how a single individual was able to attack Internet users for over a year without much resistance,” Fox-IT analysts said. “The ease at which cybercrime services are available to criminals, makes it trivial for anyone to start in this business. The potential gains for the criminals are large, with little to no chance of successful prosecution.”
Click here for a full report on the botnet.