In a series of simultaneous actions on Thursday 9 April, 10 command and control servers were seized in the Netherlands, with additional servers taken down in the US, Russia, Luxembourg and Poland. The operation involved officers from the Dutch National High Tech Crime Unit (NHTCU) in the Netherlands, the Federal Bureau of Investigation (FBI) in the US, the Police Grand-Ducale Section Nouvelles Technologies in Luxembourg, and the Russian Ministry of the Interior’s Cybercrime Department “K” supported by the INTERPOL National Central Bureau in Moscow.
This is expected to significantly disrupt the botnet’s operation. It will increase the cost and risk for cybercriminals intent on continuing their illegal business and will prevent victims’ computers from participating in malicious schemes.Information and intelligence is now being gathered in order to identify the actors behind the Simda botnet; the people who applied to their criminal activities the business model of charging affiliate partners.
“This successful operation highlights the value of, and need for partnerships involving national and international law enforcement and private industry in the fight against the global threat of cybercrime,” said Sanjay Virmani, Director of the INTERPOL Digital Crime Centre. “The operation has dealt a significant blow to the Simda botnet. INTERPOL will continue its work to assist member countries in protecting their citizens from cybercriminals and to identify other emerging threats.”
“Botnets are geographically distributed networks and it is usually a challenging task to take down such a thing. That’s why the collaborative effort of both private and public sectors is crucial here – every party makes its own important contribution to the joint project. In this case, Kaspersky Lab’s role was to provide technical analysis of the bot, collect botnet telemetry from the Kaspersky Security Network and advise on takedown strategies,” added Vitaly Kamluk, Principal Security Researcher at Kaspersky Lab, and currently on secondment to INTERPOL.
