Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Alleged Cybercriminals Behind DNSChanger Malware Being Extradited to US

Estonia has agreed to extradite three citizens to the United States over their involvement an alleged multi-million dollar cybercrime scheme that utilized the infamous DNSChanger malware

Estonia has agreed to extradite three citizens to the United States over their involvement an alleged multi-million dollar cybercrime scheme that utilized the infamous DNSChanger malware

According to a report from the AFP, the Estonian government approved an earlier court ruling to extradite Timur Gerassimenko, Dmitri Jegorov and Konstantin Poltev to the US to stand trial for their involvement in a scheme that generated an estimated $14 million for the group of cybercriminals over a period of several years.

To carry out the scheme, the cybercriminals installed DNSChanger malware which modified the DNS server settings on infected systems. Once victims’ computers became infected with the malware, when they attempted to visit certain Web sites, their Web browsers would be re-routed to other Web sites and servers, and presented with ads that the criminals profited from through “click hijacking” and other advertising fraud schemes.

For example, using the DNSChanger Malware and rogue DNS servers, the cybercriminals replaced legitimate ads on Web sites with substituted advertisements that resulted in them generating advertising revenue.

At one point, security firm IID said that roughly half of all Fortune 500 companies and “major” U.S. federal agencies were infected with the DNSChanger malware. 

The accused cybercriminals were arrested along with three others in Estonia in November 2011 during “Operation Ghost Click“, a joint operation conducted by the FBI and international authorities.

During Operation Ghost Click, the FBI raided data centers in New York City and Chicago, taking down more than 100 servers that made up the command & control (C&C) infrastructure to support the massive botnet operation. 

After the rogue servers were taken down, under a court order, the Internet Systems Consortium began operating replacement DNS servers for the attackers’ network to give organizations and individuals a chance to identify infected hosts and remove malware from systems, before a July 9 2012 deadline when the replacement servers were set to be taken down and essentially booting infected systems off the Internet.

Advertisement. Scroll to continue reading.

Related: The Day The Internet Will Break For Millions

Written By

For more than 15 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is founder and director of several leading cybersecurity industry conferences around the world.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Discover strategies for vendor selection, integration to minimize redundancies, and maximizing ROI from your cybersecurity investments. Gain actionable insights to ensure your stack is ready for tomorrow’s challenges.

Register

Dive into critical topics such as incident response, threat intelligence, and attack surface management. Learn how to align cyber resilience plans with business objectives to reduce potential impacts and secure your organization in an ever-evolving threat landscape.

Register

People on the Move

Gigamon has promoted Tony Jarjoura to CFO and Ram Bhide has been hired as Senior VP of engineering.

Cloud security firm Mitiga has appointed Charlie Thomas as Chief Executive Officer.

Cynet announced the appointment of Jason Magee as Chief Executive Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.