Microsoft says disrupts cybercrime rings with roots in Kuwait, Algeria

Mon Jun 30, 2014 3:17pm EDT
Email This Article |
Share This Article
  • Facebook
  • LinkedIn
  • Twitter
| Print This Article | Single Page
[-] Text [+]

By Jim Finkle

BOSTON, June 30 (Reuters) - Microsoft Corp launched what it hopes will be the most successful private effort to date to crack down on cyber crime by moving to disrupt communications channels between hackers and infected PCs.

The operation, which began on Monday under an order issued by a federal court in Nevada, targeted traffic involving malicious software known as Bladabindi and Jenxcus, which Microsoft said work in similar ways and were written and distributed by developers in Kuwait and Algeria.

It is the first high-profile case involving malware written by developers outside of Eastern Europe, according to Richard Domingues Boscovich, assistant general counsel of Microsoft's cybercrime-fighting Digital Crimes Unit.

"We never seen malware coded outside Eastern Europe that is as big as this. This really demonstrates the globalization of cybercrime," said Boscovich, whose team at Microsoft has disrupted nine other cybercrime operations over the past five years, all of which it believes originated in Eastern Europe.

He said it would take several days to determine how many machines were infected, but noted that the number could be very large because Microsoft's anti-virus software alone has detected some 7.4 million infections over the past year and is installed on less than 30 percent of the world's PCs.

The malware has slick dashboards with point-and-click menus to execute functions such as viewing a computer screen in real time, recording keystrokes, stealing passwords and listening to conversations, according to documents filed in U.S. District Court in Nevada on June 19 and unsealed Monday.

The malicious software was purchased by at least 500 customers, who are identified in the court documents as John Does 1 to 500.

Boscovich said the developers blatantly marketed their malware over social media, including videos on Google Inc's YouTube and a Facebook page. They posted instructional videos with techniques for infecting PCs, he said.   Continued...