US, European police take down highly elusive botnet known as Beebone

US and European police have shut down a botnet that provided a captive audience of backdoored PCs to criminals who were looking for an easy way to quickly install malware on large numbers of computers.

The takedown of the Beebone botnet is something of a coup because the underlying malware was so resistant to detection. Polymorphic downloader software at the heart of the malicious program updated itself as many as 19 times a day. Beebone also relied on a pair of programs that re-downloaded each other, acting as an insurance policy should one of them be removed, authorities told the Associated Press. "From a techie's perspective, they made it as difficult as they possibly could for us," a Europol advisory told the news organization.

The takedown was a joint operation that involved the US FBI, Europol's European Cybercrime Center, and private security groups including Kaspersky Lab, Shadowserver, and McAfee.

According to Europol, initial figures showed that Beebone had infected about 12,000 computers. That's a relatively small number since some botnets commandeer millions of end-user devices. Officials said there are likely many more Beebone victims. There are more than five million unique samples of the underlying downloader worm, known as W32/Worm-AAEH, with more than 205,000 samples taken from 23,000 systems in 2013 and 2014. The infected computers are spread across more than 195 countries, with the US reporting the biggest number of compromises, followed by Japan, India, and Taiwan. Infections were also hard to eradicate because the malware blocked connections to antivirus websites.

The takedown was carried out by "sinkholing" the Beebone command-and-control network. Sinkholing is the process of seizing all domain names and IP addresses used to centrally control the infected machines. The whitehats performing the takedown set up their own command channel that prevented the computers from downloading malware updates or participating in any other botnet activities. To be fully free of the Beebone menace, infected computers still must be disinfected using AV software or, better yet, by having their hard drives wiped and operating systems reinstalled. Authorities are in the process of contacting Internet service providers and computer emergency response teams around the world to help identify and contact individual victims.

Beebone's demise is just the latest internationally coordinated takedown of a botnet. Previous takedowns have affected Grum, which was the world's number-three spam-delivering botnet when it was brought down in 2012; a year later, the ZeroAccess botnet that infected two million PCs and cost search engines $2.7 million per month; and last year's Gameover ZeuS trojan that helped spread the CryptoLocker ransomware. In February, authorities cracked down on Ramnit, which had infected more than 3.2 million computers.

The string of takedowns is encouraging because they demonstrate the growing ability of police and private industry to launch highly coordinated operations that can sever large, international criminal operations from the Internet in a single stroke. Then again, the steady stream of actions underscores the persistence of the botnet menace that can only be kept in check with still more enforcement.