• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Botnets   »   A Stark Message to Cybercriminals: You Are Not Invisible, You Are Not Beyond the Law

A Stark Message to Cybercriminals: You Are Not Invisible, You Are Not Beyond the Law

  • Posted on:March 21, 2011 at 8:00 am
  • Posted in:Botnets
  • Author:
    Ranieri Romera (Senior Threat Researcher)
15

Around the world, every day, security researchers study the activities, behaviors, forum communications, and networks of cybercriminals in an effort to make the world safe for the exchange of digital information.

In addition to preventing attacks, we gather and share intelligence with the appropriate industry anti-cybercrime groups and law enforcement authorities.

We’ve been tracking for one particular criminal who we’ll call Mr. L for some time now. He’s been preying on innocent users, primarily from Chile and Mexico, and according to our latest findings, he is still up to his old tricks of data and monetary theft. Just last week, we discovered an active command-and-control (C&C) server plus other criminal tools, including one based on a customized version of the CrimePack Exploit Pack, a practice that this criminal has carried out with his previous botnets.

We’ve already shared our findings with our law enforcement contacts but wanted you to also be aware, on your toes, and on the lookout for suspect email messages and other events.

So what do we know so far?

In September 2010, we published an in-depth research paper that discussed the technical aspect of this particular criminals’ botnets and toolkits.

The first botnet Trend Micro identified was the Tequila botnet. Then came the Mariachi botnet and the Alebrije and Mehika Twitter botnets. These botnets are collectively known as the Botnet PHP family.

The attacks began in May 2010, when some users in Mexico received an email containing fake news about “nude pictures” of a missing four-year-old girl’s mother. This was used as bait to lure users into downloading and installing a malicious application via a malicious URL.

Interestingly, through our analysis, we found that certain words or terms were repeated in the content of the script used to install the bot client. They didn’t mean much to us at that point but gave us something to work with.

During our research, we went looking for an active C&C center and subsequently discovered one hosted at http://www.botnet.{BLOCKED}.tk/Admin. At this URL, we found some more information about the author… On the login page, the author chose to promote his services—and included his name, email addresses, and mobile phone number!

Now armed with a name, two email addresses, and a phone number registered to the Guadalajara Metropolitan Region in Mexico, we tracked down Mr. L.

As already indicated, it’s Trend Micro’s policy to hand over any relevant information related to criminal activities to law enforcement authorities.

As a message to anyone even considering criminal misdeeds—don’t do it!

We know the following about Mr. L:

  • He was apparently born in 1987 and is a student at Netec. He resides in Zapopan, Mexico.
  • Trend Micro has collected Gmail and Hotmail account details, etc.
  • We also have social networking details, photos, nicknames, and other pertinent information.

While we have many very specific personally identifiable details, we have chosen not to publish them here.

Remember, anyone acting online, for good or bad, will leave a trace.

To our customers, we work to secure you. We want you to know that we won’t stop working to protect you, we won’t stop scrutinizing criminal activities and we will continue to work with law enforcement authorities in order to stop these criminals from defrauding you, your family, and your friends.

Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»

Featured Stories

  • systemd Vulnerability Leads to Denial of Service on Linux
  • qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware
  • Mitigating CVE-2017-5689, an Intel Management Engine Vulnerability
  • A Closer Look at North Korea’s Internet
  • From Cybercrime to Cyberpropaganda

Security Predictions for 2018

  • Attackers are banking on network vulnerabilities and inherent weaknesses to facilitate massive malware attacks, IoT hacks, and operational disruptions. The ever-shifting threats and increasingly expanding attack surface will challenge users and enterprises to catch up with their security.
    Read our security predictions for 2018.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • Monero-Mining RETADUP Worm Goes Polymorphic, Gets an AutoHotKey Variant
  • XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing
  • XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner
  • Not Only Botnets: Hacking Group in Brazil Targets IoT Devices With Malware

Popular Posts

  • New MacOS Backdoor Linked to OceanLotus Found
  • Monero-Mining HiddenMiner Android Malware Can Potentially Cause Device Failure
  • ChessMaster Adds Updated Tools to Its Arsenal
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner
  • Not Only Botnets: Hacking Group in Brazil Targets IoT Devices With Malware

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.