# FBI and Microsoft Corp in joint assault on £500m fraud botnet

Microsoft's digital crimes unit takes down at least 1,000 Citadel botnets in attempt to curb £500m theft from bank accounts

- Share
- Tweet this
- Email

- Reuters in Boston
- guardian.co.uk, Thursday 6 June 2013 15.36 BST

Microsoft and the FBI have launched a major assault on one of the world's biggest cybercrime rings. Photograph: Kacper Pempel/Reuters

Microsoft Corp and the FBI, aided by authorities in more than 80 countries, have launched a major assault on one of the world's biggest cybercrime rings, believed to have stolen more than $500m (£323m) from bank accounts over the past 18 months.

Microsoft said its digital crimes unit had successfully taken down at least 1,000 of an estimated 1,400 malicious computer networks known as the Citadel botnets.

Citadel infected as many as 5m PCs around the world and, according to Microsoft, was used to steal from dozens of financial institutions, including American Express, Bank of America, Citigroup, Credit Suisse, PayPal, HSBC, JPMorgan Chase, Royal Bank of Canada and Wells Fargo.

While the criminals remain at large and the authorities do not know the identities of any ringleaders, the internationally co-ordinated take-down dealt a significant blow to their capabilities.

"The bad guys will feel the punch in the gut," said Richard Domingues Boscovich, assistant general counsel with Microsoft's digital crimes unit.

Botnets are armies of infected personal computers, or bots, which run software forcing them to regularly check in with and obey "command and control" servers operated by hackers. Botnets are typically used to commit financial crimes, send spam, distribute computer viruses and attack computer networks. Citadel is one of the biggest botnets in operation today. Microsoft said its creator bundled the software with pirated versions of the Windows operating system and used it to control PCs in the US, western Europe, Hong Kong, India and Australia.

The FBI said it is working closely with Europol and other overseas authorities to try to capture the unknown criminals. It has obtained search warrants as part of what it characterised as a "fairly advanced" criminal probe.

"We are upping the game in our level of commitment in going after botnet creators and distributors," the FBI's assistant executive director, Richard McFeely, said.

"This is a more concerted effort to engage our foreign partners to assist us in identifying, locating and, if we can, get US criminal process on these botnet creators and distributors."

Microsoft has filed a civil lawsuit in the US district court in Charlotte, North Carolina against the unknown hackers and obtained a court order to shut down the botnets. The complaint, unsealed on Wednesday, identifies the ringleader as John Doe No 1, who goes by the alias Aquabox and is accused of creating and maintaining the botnet.

Boscovich said investigators are trying to determine Aquabox's identity and suspect he lives in eastern Europe and works with at least 81 "herders", who run the bots from anywhere in the world.

The Citadel software is programmed so it will not attack PCs or financial institutions in Ukraine or Russia, likely because the creators operate in those countries and want to avoid provoking law enforcement officials there, Microsoft said.

According to Microsoft, Citadel was used to steal more than $500m from banks in the US and abroad, but the company did not specify losses at individual accounts or firms.

The American Bankers Association (ABA), one of three financial industry groups that worked with Microsoft, said any success in reducing the number of active Citadel botnets will reduce future losses incurred by banks and their customers.

"I am hopeful we have a model that will allow us to get closer and closer to those who are the ultimate perpetrators of these crimes," said ABA's vice-president, Doug Johnson.

In the US, banks typically reimburse consumers when they are victims of cybercrime, but they may require business customers to absorb those losses, the ABA said.

Microsoft's team of digital detectives, who are based at its corporate headquarters in Redmond, Washington, have been involved in seven efforts to attack botnets since 2010. The latest marks its first collaboration with the FBI.

The software maker sought help from the FBI about 10 days ago. At that time the agency told Microsoft that it had already done significant work on a criminal investigation into the Citadel botnets, McFeely said.

Microsoft said it and the FBI were working with law enforcement and other organisations in countries including Australia, Brazil, Ecuador, Germany, Holland, Hong Kong, Iceland, India, Indonesia, Spain and the UK.

Of the more than 1,000 botnets that were shut down on Wednesday, Microsoft said 455 were hosted in 40 data centres in the US. The rest were located in dozens of countries overseas.

Technicians from Microsoft, accompanied by US marshals, visited two data centres in Scranton, Pennsylvania and Absecon, New Jersey to collect forensic evidence.

Boscovich said the data centre operators typically were not aware that their servers were being used to run botnets. "There is no responsibility on their part to see what is in the pipes," he said.

It is the second time Microsoft's digital crimes unit has sought to bring down a large number of botnets at once. In March 2012 it targeted hundreds of Zeus botnets, which use similar software and infrastructure to Citadel, though they were not as sophisticated.

That effort succeeded in shutting just a quarter of the approximately 800 targeted Zeus command and control servers, according to Microsoft. Zeus is not controlled by a single developer like Citadel, which made it harder for investigators to track and knock out herders.

Cybercriminals typically infect machines by sending spam emails containing malicious links and attachments, and by infecting legitimate websites with computer viruses that attack unsuspecting visitors. Some bot herders rent or sell infected machines on underground markets to other cybercriminals looking to engage in a wide variety of activities.

The Citadel software disables anti-virus programs on infected PCs so they cannot detect malicious software. It surfaced in early 2012 and is sold over the internet in kits that cost $2,400 or more.

Boscovich said he believes that Aquabox also gets a percentage of money stolen by his customers using Citadel.

The kits allow herders to easily set up and run botnets on pirated versions of Microsoft's Windows XP operating system, according to court documents. The kits include modules for infecting PCs, as well as stealing from online banking sites, sending spam and engaging in other types of cybercrime.

Some Citadel botnet operators have used infected machines to disrupt bank websites in so-called distributed denial of service attacks, hoping to distract those firms from thefts that are occurring or have occurred, according to the complaint.

Aquabox provided herders a secret forum where they could suggest new features for the Citadel kits, as well as exchange ideas on best practices in botnet herding, Microsoft said.

- Print this
- Share
- Contact us

### Send to a friend

Sender's name
Recipient's email address

Your IP address will be logged

### Share

Short link for this page: http://gu.com/p/3gcfa

- StumbleUpon
- reddit
- Tumblr
- Digg
- LinkedIn
- Google Bookmarks
- del.icio.us
- livejournal
- Facebook
- Twitter

### Contact us

- Contact the Technology editor
  tech@guardian.co.uk
- Report errors or inaccuracies: userhelp@guardian.co.uk
- Letters for publication should be sent to: letters@guardian.co.uk

- If you need help using the site: userhelp@guardian.co.uk
- Call the main Guardian and Observer switchboard:
  +44 (0)20 3353 2000
- - Advertising guide
  - License/buy our content

Article history

### About this article

FBI and Microsoft Corp in joint assault on £500m fraud botnet

This article was published on guardian.co.uk at 15.36 BST on Thursday 6 June 2013. It was last modified at 15.36 BST on Thursday 6 June 2013. It was first published at 12.05 BST on Thursday 6 June 2013.

#### Technology

- Cybercrime ·
- Microsoft ·
- Computing ·
- Internet

#### World news

- Massachusetts ·
- United States

More news

- Share
- Tweet this
- Email

### Today's best video

- #### Smartphone face-off: HTC One v Samsung Galaxy S4

  Charles Arthur compares two of the most popular new smartphones: the HTC One and the Samsung Galaxy S4

- #### Surfing the perfect wave

  Michael Fordham travels from San Francisco to LA lapping up American surf culture

- #### How to dress: flapper dresses

  Jess Cartner-Morley picks out some Gatsby-esque gems from the high street

- #### José Mourinho: Cristiano Ronaldo 'thinks he knows everything'

  New Chelsea manager criticises Ronaldo

### GuardianWitness

- New shoots of student feminism

  From burnt bras to feminist graffiti and event flyers, we want to see evidence of the new feminism on your campus. Share your images and videos

- UK seaside resorts: then and now

  Which regeneration projects have brought a new lease of life to the UK's seaside towns? Share your photos from the past and the present

- How fast is your pet?

  Can your cat zoom up and down a tree in the blink of an eye? Is your dog a serious speed-eater? Or is your hamster a whizz in its wheel? Share your videos

- Send us your assignment ideas

  Do you have an idea for an assignment you think should run on GuardianWitness? Let us know.

### Guardian Audio Edition

- The hypocrisy at the heart of the Bradley Manning trial

  Whilst soldiers who kill innocent people remain free, the man who exposed them is accused of 'aiding the enemy'; The UK government is terrified of appearing to allow the EU to undermine British 'interests' - in this week's Guardian Audio Edition. Listen now

- Media Network

  ## Least developed countries are vital for global security

  If the number of internet users in LDCs continues to rise, it is crucial that we have a co-ordinated global response to information security incidents

- Media Network

  ## How much would a security breach cost your business? – infographic

  Information security incidents are on the rise as cyber criminals increase their focus on both large and small businesses

- ## More from our Media network

### Microsoft news on Twitter

Follow the latest tweets about Microsoft from the Guardian's technology team

- charlesarthur: By me Guardian: Boot up: iPads are PCs (Microsoft says), patent trolls unmasked, Denmark's snoopers, and more http://t.co/heQmD1O4Ln #fb

  about 3 days, 9 hours ago

- jemimakiss: Guardian >> Bootup: Cisco says Microsoft/Skype deal was unfair, China plans Taiwan firewall, and Samsung trumps... http://t.co/CGwwGD9wf7

  about 1 week ago

- guardiantech: Post-PC: why are Microsoft and HP thriving? http://t.co/DZYvS5CiBX

  about 1 week, 2 days ago

• Follow our team Twitter list for more news

### On Technology

- Most viewed
- Latest

Last 24 hours

1. 1. Smartphone face-off: HTC One v Samsung Galaxy S4 - video reviews
2. 2. The Last of Us – review
3. 3. FBI and Microsoft Corp in joint assault on £500m fraud botnet
4. 4. How can I encrypt my laptop to protect my personal data?
5. 5. Chatterbox: Thursday
6. More most viewed

Last 24 hours

1. 1. DRM and HTML5: it's now or never for the Open Web
2. 2. Tech Weekly podcast: Rytis Vitkauskas on the YPlan app, E3
3. 3. FBI and Microsoft Corp in joint assault on £500m fraud botnet
4. 4. iOS v Android? They're both winning, and so are the people who use them
5. 5. How can I encrypt my laptop to protect my personal data?
6. All today's stories

### Today's top internetting

- From the funniest viral videos to the top news stories - find out what's being shared on the web right now. See more

###

#### This week's bestsellers

1. 1. Sam 2010 Assessment, Training, and Projects V2.0 Printed Acc

   £36.00

2. 2. Rough Guide to the Best iPhone and iPad Apps

   £3.99

3. 3. Art of Dead Space

   by Martin Robinson £23.99

4. 4. Alan Turing: Enigma

   by Andrew Hodges £8.79

5. 5. Essential Turing

   by B Jack Copeland £25.00

Search the Guardian bookshop

### Bestsellers from Guardian Gadgets

- Driving Recorder
  Films the road ahead while you drive. Can help with insurance should you have an accident. Just £49.99
  More from Guardian Gadgets
- Long Reach Hedge Trimmer
  Lightweight, telescopic and easy to use. Just £79.95 with free delivery
  More from Guardian Gadgets

### Subscribe to the paper and get digital access

- Choose from one of our four subscription packages and save up to 32%. From just £4.99 a week, you'll receive your papers plus iPhone and iPad access. Learn more

### Top stories in this section

### Top videos

### Most popular

### Today in pictures

- #### BBC Sports Personality of the Year – in pictures

  Bradley Wiggins capped his remarkable sporting year by taking home the big prize at the ceremony in London

- #### Dinner, dusk and dancing Russians: my best winter shot

  A glass of wine with a rough sleeper, Santa in trunks, a thousand partying Muscovites … in a My Best Shot special, top photographers pick the image that sums up winter for them

- #### Monkey adopts kitten – in pictures

  Kimon, an eight-year-old pet female long-tailed monkey, treats a kitten as her baby in Bintan Island, Indonesia

- Share
- Tweet this