Malware Database

Download the PDF version here.

In May 2009, Defence Intelligence, a private information security firm based in Canada began investigating a suspicious new malware sample that was communicating with Command & Control (C&C) servers located in Spain. “Mariposa,” the Spanish word for butterfly, was given to the botnet by Defence Intelligence researchers after several months of probing. Early suspicion was accurate because further investigation eventually led to the discovery of 13 million newly infected machines communicating with the C&C servers. This rapid growth urgently signaled the need for an international coalition to conduct the research, investigation, and takedown efforts of the largest botnet ever recorded in history.

The result was The Mariposa Working Group, comprised of several experts in the Information Security sector including Defence Intelligence, Panda Security, the Georgia Tech Information Security Center, the FBI and the Spanish Civil Guard.  The focus of the group was to identify and eradicate the botnet, as well as bring the cyber criminals to justice.

During the initial stages of research, the Mariposa Working Group discovered that the Mariposa botnet was masterminded by an amateur-run group of several spirited script kiddies named Días de Pesadilla (DDP), which translates to “Nightmare Days Team.”  Uncovered underground forum communication showed that instead of building a complex self-coded botnet infrastructure, the DDP team leveraged the underground community to buy the tools that they needed to build the 13 million strong botnet. In fact, the botnet operators even leveraged the widely popular Zeus crimeware kit, which is a do-it-yourself tool used by many amateur botnet operators today.

The DDP team also bought malware tools (crypters, packers, kits, etc.) on these forums to sell to other members. dDoS services, Adware/Toolbar installs and Botnet rental (primarily for credential harvesting), were among the favorites and it was through this underground forum that the Mariposa botnet became a financially viable tool for the cyber criminals.

The underground communication also enabled the Mariposa Working Group to identify the botnet leader, who was only known by the handle “Netkairo.” Tracking the operator became very difficult, as he only used anonymous VPN services to connect to the botnet infrastructure. The chances of catching the operator were slim, so a more aggressive approach was taken to cease all activity.  On December 23^rd, 2009, the Mariposa botnet was effectively taken over by rerouting the command and control servers DNS records to a sinkhole. Nearly 13 million infected machines immediately began sending beacon signals back to the sinkhole and it was this time that the Mariposa Working Group identified infections in government computers, universities and more than half of the nation’s Fortune 1000 companies.

In a last ditch effort to regain control of the botnet, Netkairo frantically connected to the botnet infrastructure using his home broadband connection. He was able to temporarily regain control of the botnet and subsequently launch a denial of service attack on Defence Intelligence, nearly taking an entire ISP down in the process. This single action proved to be a fatal mistake and the linchpin in unraveling the entire DDP team. The Mariposa Working Group worked in conjunction with Netkairo’s ISP in identifying the botnet masters’ whereabouts and on February 3^rd, 2010 the Spanish Civil Guard quickly moved to arrest the 31-year-old Spaniard at his home in the Basque region of Spain. The investigation of Netkairo’s personal computer led to the discovery of various types of stolen data including bank account details, credit card numbers, user names and passwords from approximately 800,000 victims, as well as evidence which led to the capture of another two Spanish members of the gang: J.P.R., 30,  a.k.a. “jonyloleante”, and  J.B.R., 25, a.k.a. “ostiator,” who were both arrested on February 24^th, 2010.

Victims of Mariposa include home users, companies, government agencies and universities in more than 190 countries.  Christopher Davis, CEO of Defence Intelligence, illustrates the significance of these infections with this one statement: “It would be easier for me to provide a list of the Fortune 1000 companies that weren’t compromised, rather than the long list of those who were.”

The investigation is still ongoing, but preliminary calculations of the losses through fraud, financial theft, data loss and cleanup costs are estimated to be in the millions of dollars.  Analysis of Netkairo’s hard disks revealed a complex network of suppliers offering a range of services including hacking of servers to be used as control servers, encryption services to make the bots undetectable by antivirus programs, anonymous VPN connections to administer the botnet, etc.  There is also a similarly complex network of clients, prepared to rent part of the botnet, to buy stolen credit cards, or pay for the installation of toolbars. The gang also stole directly from bank accounts, using money mules in the United States and Canada, and laundered money through online poker games.

Cases like Mariposa demonstrate the growing trend of the amateur run botnets. Do-it-yourself kits like ZeuS, SpyEye, Elenore, and many others are widely available on the Internet underground and it’s these tools that allowed the amateurs behind the Mariposa botnet to build a 13 million strong victim pool. Fortunately, as cybercriminal attacks continue to increase in frequency and sophistication, information is gleaned for security vendors to develop new tools and law enforcement agencies to develop new strategies for bringing these criminals to justice.

Yesterday, Microsoft issued a security advisory for an unpatched and actively exploited invalid reference pointer vulnerability in the Internet Explorer 6 and 7 web browsers. In the attack we observed, the exploit code will load the TDSS.CQ trojan, which is designed to steal personal and sensitive data.  Only versions 6 and 7 of Internet Explorer are vulnerable, but you can take additional steps to avoid it by using an alternative browser such as, Firefox, Opera, or by upgrading to Internet Explorer 8.

I went ahead and put together a little video to show you all how the exploit works:

Note: Originally posted on the PandaLabs blog.