Microsoft blames Russians for Rustock botnet

Yesterday we reported on the seizing of hard drives and other equipment belonging to the Rustock botnet. This was a major victory for Microsoft. Email addresses were found on the hard drives. In addition, there are signs the drives were used in the TOR network.

Arstechnica is reporting that in the court report filed by Microsoft on Monday, additional info has come to light. Websites such as mail.ru and freesoft.ru were accessed on some of the systems used in the botnet. Some of the hosting for the servers was paid for by a Webmoney account, a payment system widely used in Russia. This is the account that was tied to the previously mentioned Vladimir Alexandrovich Shergin.

Microsoft has also revealed that another nickname is now associated with the botnet. Cosma2k is a nickname associated in part with the command and control servers. At this time, Microsoft has associated this nickname with some real names. According to Microsoft, they are following up on any leads. Microsoft does note that they have not received communication from any defendant possibly involved in the Rustock botnet. Microsoft says that the investigation is ongoing. They will continue to provide status updates as the investigation proceeds. However, one can now start to assume that there was likely some Russian involvement in this, at least by Russian hackers.

Report a problem with article
Previous Story

Diablo III web update talks about runestones

Next Story

Facebook planning to integrate Spotify music service

8 Comments

Fus10n said,
Why does it matter if the drives where used in the TOR network? and what excatly is that?

IIRC Tor was a huge botnet.

Mr. Black said,

IIRC Tor was a huge botnet.

Ummmm....no.

TOR used to be The Onion Routing project but I don't think they use that name any longer. Basically it's an anonymous network setup by volunteers that allows you to communicate on the internet anonymously which normally isn't possible due to traditional routing requirements. Some people use it because they're paranoid, other's because they're up to no good. The only weakness is that the endpoints could potentially be sniffing traffic and put together the pieces but that's no worse than what could potentially happen at any major routing point at your ISP or other ISP's.

TOR is the mighty son of Odin. He owns the worlds most awesome hammer and he travels the world interfering with people's internet connections by placing his hammer near telco copper-wires and the magnetic interference caused by TOR's hammer cripples data transfer rates to 1.2k baud modem rates.

TOR is hated and despised by l33t users for his slow speeds. Most l33t's concider TOR to be retarded.

MaJoR ChAoS said,
TOR is the mighty son of Odin. He owns the worlds most awesome hammer and he travels the world interfering with people's internet connections by placing his hammer near telco copper-wires and the magnetic interference caused by TOR's hammer cripples data transfer rates to 1.2k baud modem rates.

TOR is hated and despised by l33t users for his slow speeds. Most l33t's concider TOR to be retarded.

I approve this comment.

MaJoR ChAoS said,
TOR is the mighty son of Odin. He owns the worlds most awesome hammer and he travels the world interfering with people's internet connections by placing his hammer near telco copper-wires and the magnetic interference caused by TOR's hammer cripples data transfer rates to 1.2k baud modem rates.

TOR is hated and despised by l33t users for his slow speeds. Most l33t's concider TOR to be retarded.


I bequeath to you my first born child..

This post was epic.

MaJoR ChAoS said,
TOR is the mighty son of Odin. He owns the worlds most awesome hammer and he travels the world interfering with people's internet connections by placing his hammer near telco copper-wires and the magnetic interference caused by TOR's hammer cripples data transfer rates to 1.2k baud modem rates.

TOR is hated and despised by l33t users for his slow speeds. Most l33t's concider TOR to be retarded.

Wow, that was awesome!

Commenting is disabled on this article.