FBI Talks Avalanche Botnet Takedown

FBI unit chief Tom Grasso explains the takedown of Avalanche and how the agency approaches botnet infrastructures.

BLACK HAT USA - Las Vegas - Tom Grasso, unit chief of the FBIs cyber division, took the Black Hat stage to discuss the processes and partnerships leading up to the massive Avalanche takedown in December 2016.
Avalanche wasnt a botnet, he noted at the beginning of his talk. It was an infrastructure for enabling botnets, created by two administrators and active since 2010. The multitiered network of servers was used to spread malware campaigns, facilitate money mule laundering schemes, and act as a fast-flux communication infrastructure for other botnets.
The network affected more than 500,000 systems and caused hundreds of millions of dollars in losses. Malware powered by Avalanche included Nymain ransomware and GozNym, a banking Trojan designed to steal credentials and initiate fraudulent wire transfers.
Grasso displayed an ad for Avalanche on criminal forum DirectConnection, where it was described as ideal for hosting Trojans with bulletproof hosting and high-speed uplinks. More than 800,000 malicious domains were associated with Avalanche; its complexity demonstrates the great lengths criminals will go to, to make this work, he explained.
Were not talking about some kid in his moms basement; … were talking about businessmen. This is a business to them, he said. This was a strategic move by the criminals running this to add another level of complexity to make it unsusceptible to law enforcement intervention.
As part of his presentation, Grasso discussed the FBIs approach to reducing the threat of botnets. Its steps include neutralizing threat actors through arrest, charge, and prosecution; disabling the infrastructure; and mitigating the threat by sharing IOCs and signatures.
Working with the private sector is essential, he added. Private sector businesses identify priority threats and the FBI works with them to brainstorm solutions. Both sides share intel on the problem and determine a way to neutralize the threat.
The FBI worked with private companies, international organizations, and foreign governments to take down Avalanche. Partner organizations included FBI agents, German state and federal police, Ukrainian police, Shadowserver, nonprofit Registrar of the Last Resort, and Fraunhofer, a German company that mapped out the technical patterns of Avalanche.
The criminals are really excellent at collaborating. … Its one of the reasons theyre great at what they do, said Grasso. If were going to do something about these problems, its gonna be a joint effort.
In November 2015, it was discovered the administrators behind Avalanche were using a private server in Moldova to communicate with clients and for the domain registration panel. In January 2016, they moved the functions of the Moldovan server to a private server in the US.
A search warrant on the private server revealed email addresses for the administrators and a buddy list with more than 200 clients. Official discovered easy-reg.net was an administrative panel that stated 3,000 domains run over Avalanche websites. One chat discovered by officials included an explanation of the fast-flux decisions driving criminal activity on the network.
The investigation of Avalanche included the arrest of five individuals and searches across four countries, the seizing of servers, and an unprecedented effort to sinkhole more than 800,000 malicious domains associated with the infrastructure.
Going forward, Grasso emphasized the importance of working with private and international partners as criminals conduct operations abroad.
The bad guys are never in your country. … Theyre always somewhere else when youre investigating this stuff, he said.
Related Content:
Hacking the Wind
Dark Reading News Desk Live at Black Hat USA 2017
Majority of Consumers Believe IoT Needs Security Built In
10 Critical Steps to Create a Culture of Cybersecurity

Last News
▸ NSA evaluates IT access control limits ◂ Discovered: 26/12/2024 Category: security	▸ Insights from Prism: 8 Key Metadata Points ◂ Discovered: 26/12/2024 Category: security	▸ Survey finds customers expect to be asked and compensated for personal data use. ◂ Discovered: 26/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
FBI Talks Avalanche Botnet Takedown