Around the world, every day, security researchers study the activities, behaviors, forum communications, and networks of cybercriminals in an effort to make the world safe for the exchange of digital information.
In addition to preventing attacks, we gather and share intelligence with the appropriate industry anti-cybercrime groups and law enforcement authorities.
We’ve been tracking for one particular criminal who we’ll call Mr. L for some time now. He’s been preying on innocent users, primarily from Chile and Mexico, and according to our latest findings, he is still up to his old tricks of data and monetary theft. Just last week, we discovered an active command-and-control (C&C) server plus other criminal tools, including one based on a customized version of the CrimePack Exploit Pack, a practice that this criminal has carried out with his previous botnets.
We’ve already shared our findings with our law enforcement contacts but wanted you to also be aware, on your toes, and on the lookout for suspect email messages and other events.
So what do we know so far?
In September 2010, we published an in-depth research paper that discussed the technical aspect of this particular criminals’ botnets and toolkits.
The first botnet Trend Micro identified was the Tequila botnet. Then came the Mariachi botnet and the Alebrije and Mehika Twitter botnets. These botnets are collectively known as the Botnet PHP family.