Microsoft names alleged Zeus bot herders

When Microsoft disrupted two of the most harmful botnets using Zeus malware in March, they also filed a lawsuit at the federal district court in New York against the bot herders who, at the time, were unknown and defined only as “John Doe” defendants.

But Richard Boscovich, Senior Attorney with Microsoft Digital Crimes Unit, has yesterday revealed that they have amended the complaint and named two Ukrainian man as defendants: one Yevhen Kulibaba and one Yuriy Konovalenko.

The have also discovered that these men were currently serving jail time in the UK for other Zeus malware related charges, to which they pleaded guilty and were sentenced for last year.

“Microsoft has advised the UK government of the criminal referral to the FBI,” shared Boscovich, meaning that once the two men serve their sentences, they will likely be extradited to the US for this trial.

“Our best efforts to identify the remaining John Doe defendants turned up no response,” wrote Boscovich, and added that Microsoft will continue their efforts to serve Kulibaba and Konovalenko, and the John Doe defendants, with this amended complaint.

In the meantime, the C&C servers Microsoft managed to shut down are still down, and according to Boscovich, this disruption has led to a sizable reduction Zeus infection rates, and the discovery of the IP addresses of many machines infected with the malware, making it possible to coordinate an action that will help people regain control of their infected computers.

“As I’ve written previously, the goal of this operation was not to entirely take out all of the botnets running on Zeus-based malware. Microsoft and our financial industry partners sought to help protect innocent people by disrupting the Zeus business model and increasing the cost of doing business for cybercriminals,” Boscovich pointed out.

“I’m happy to report that we are already seeing proof that our disruptive actions were successful in achieving this goal. We mitigated the threat and caused long-term damage to the cybercriminal organization that relies on these botnets for illicit gain.”