Microsoft Leaves Necurs Botnet in Shambles

Microsoft this week announced the success of its efforts, jointly undertaken with partners across 35 countries, to disrupt the Necurs botnet group blamed for infecting more than 9 million computers globally.

There are 11 botnets under the Necurs umbrella, all apparently controlled by a single group, according to Valter Santos, security researcher at Bitsight, which worked with Microsoft on the takedown. Four of those botnets account for about 95 percent of all infections.

"Necurs is the named exploit that is most consistently used," said Rob Enderle, principal analyst at the Enderle Group.

The U.S. District Court for the Eastern District of New York last week issued an order enabling Microsoft to take control of the U.S.-based infrastructure Necurs uses to distribute malware and infect victim computers.

Microsoft figured out the new domains Necurs would generate algorithmically and reported them to respective registries worldwide so they could be blocked.

Microsoft also is partnering with ISPs, domain registries, government CERTs and law enforcement in various countries to help flush malware associated with Necurs from users' computers.

The botnet activity stalled this month, but about 2 million infected systems remain, waiting in a dormant state for Necurs' revival.

These systems "should be identified and rebuilt" to avoig leaving them susceptible to Necurs or another botnet, Enderle told TechNewsWorld.

"They could do a lot of damage if they aren't found in time," he said.

"Microsoft is one of the few companies going after the bad actors and not just addressing the point security problems," Enderle noted. "Until the world becomes aggressive with bringing the bad actors to justice, we will continue to be at risk of a worldwide catastrophic computer event. This problem needs to be solved at the source."