{"id":3035,"date":"2013-07-26T12:18:10","date_gmt":"2013-07-26T16:18:10","guid":{"rendered":"http:\/\/blog.nccomputertech.com\/?p=3035"},"modified":"2013-07-26T12:18:10","modified_gmt":"2013-07-26T16:18:10","slug":"microsoft-almost-90-percent-of-citadel-botnets-in-the-world-disrupted-in-june","status":"publish","type":"post","link":"https:\/\/nccomputertech.com\/techtalk\/2013\/07\/26\/microsoft-almost-90-percent-of-citadel-botnets-in-the-world-disrupted-in-june\/","title":{"rendered":"Microsoft: Almost 90 percent of Citadel botnets in the world disrupted in June"},"content":{"rendered":"<p style=\"text-align:center;\"><a href=\"http:\/\/www.pcworld.com\/article\/2045282\/microsoft-almost-90-percent-of-citadel-botnets-in-the-world-disrupted-in-june.html\"><img data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/nccomputertech.com\/techtalk\/wp-content\/uploads\/2013\/07\/malware_virus-100047712-gallery.jpg\" alt='' \/><\/a><\/p>\n<p>Microsoft estimates that 88 percent of botnets running the Citadel financial malware were disrupted as a result of a takedown operation launched by the company in collaboration with the FBI and partners in technology and financial services. The operation was originally announced on June 5.<br \/>\nSince then, almost 40 percent of Citadel-infected computers that were part of the targeted botnets have been cleaned, Richard Domingues Boscovich, an assistant general counsel with Microsoft\u2019s Digital Crimes Unit, said Thursday in a blog post.<br \/>\nMicrosoft did not immediately respond to an inquiry seeking information about how those computers were cleaned and the number of computers that remain infected with the malware.<br \/>\nHowever, Boscovich said in a different blog post on June 21 that Microsoft observed almost 1.3 million unique IP (Internet Protocol) addresses connecting to a \u201csinkhole\u201d system put in place by the company to replace the Citadel command-and-control servers used by attackers.<br \/>\nAfter analyzing unique IP addresses and user-agent information sent by botnet clients when connecting to the sinkhole servers, the company estimated that more than 1.9 million computers were part of the targeted botnets, Boscovich said at the time, noting that multiple computers can connect through a single IP address.<br \/>\nHe also said that Microsoft was working with other researchers and anti-malware organizations like the Shadowserver Foundation in order to support victim notification and remediation.<br \/>\nThe Shadowserver Foundation is an organization that works with ISPs, as well as hosting and Domain Name System (DNS) providers to identify and mitigate botnet threats.<br \/>\nAccording to statistics released Thursday by Boscovich, the countries with the highest number of IP addresses corresponding to Citadel infections between June 2 and July 21 were: Germany with 15 percent of the total, Thailand with 13 percent, Italy with 10 percent, India with 9 percent and Australia and Poland with 6 percent each. Five percent of Citadel-infected IP addresses were located in the U.S.<br \/>\nBoscovich praised the collaboration between public and private sector organizations to disrupt the Citadel botnet.<br \/>\n\u201cBy combining our collective expertise and taking coordinated steps to dismantle the botnets, we have been able to significantly diminish Citadel\u2019s operation, rescue victims from the threat, and make it more costly for the cybercriminals to continue doing business,\u201d he said Thursday in the blog post.<br \/>\nHowever, not everyone in the security research community was happy with how the takedown effort was implemented.<br \/>\nShortly after the takedown, a security researcher who runs the abuse.ch botnet tracking services estimated that around 1,000 of approximately 4,000 Citadel-related domain names seized by Microsoft during the operation were already under the control of security researchers who were using them to monitor and gather information about the botnets.<br \/>\nFurthermore, he criticized Microsoft for sending configuration files to Citadel-infected computers that were connecting to its sinkhole servers, saying that this action implicitly modifies settings on those computers without their owners\u2019 consent. \u201cIn most countries, this is violating local law,\u201d he said in a blog post on June 7.<br \/>\n\u201cCitadel blocked its victims\u2019 ability to access many legitimate anti-virus and anti-malware sites in order to prevent them from being able to remove the malware from their computer,\u201d Boscovich said on June 11 in an emailed statement. \u201cIn order for victims to clean their computers, the court order from the U.S. District Court for the Western District of North Carolina allowed Microsoft to unblock these sites when computers from around the world checked into the command and control structure for Citadel which is hosted in the U.S.\u201d<br \/>\nvia <a href=\"http:\/\/www.pcworld.com\/article\/2045282\/microsoft-almost-90-percent-of-citadel-botnets-in-the-world-disrupted-in-june.html\" target=\"_blank\">Microsoft: Almost 90 percent of Citadel botnets in the world disrupted in June | PCWorld<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft estimates that 88 percent of botnets running the Citadel financial malware were disrupted as a result of a takedown [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[5,6,7,10],"tags":[142],"class_list":["post-3035","post","type-post","status-publish","format-standard","hentry","category-microsoft","category-networking","category-security","category-technology","tag-botnet"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/papNkV-MX","jetpack-related-posts":[{"id":9655,"url":"https:\/\/nccomputertech.com\/techtalk\/2021\/03\/09\/fuquay-varina-and-holly-springs-computer-repair\/","url_meta":{"origin":3035,"position":0},"title":"Fuquay Varina and Holly Springs Computer Repair","author":"NCCT","date":"March 9, 2021","format":false,"excerpt":"Welcome to our blog. NC Computer Tech services Fuquay Varina, Holly Springs, and surrounding NC areas. We offer prompt, professional, courteous service with over twenty years of experience dealing with residential and small business clients offering them solutions and fixing their computer and network issues at reasonable rates. Our services\u2026","rel":"","context":"In &quot;Technology&quot;","block_context":{"text":"Technology","link":"https:\/\/nccomputertech.com\/techtalk\/category\/technology\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":9930,"url":"https:\/\/nccomputertech.com\/techtalk\/2025\/05\/16\/fbi-says-toss-your-old-router\/","url_meta":{"origin":3035,"position":1},"title":"FBI Says Toss Your Old Router","author":"NCCT","date":"May 16, 2025","format":false,"excerpt":"https:\/\/youtu.be\/scR199zRjvA On Security Now, Steve talks about the FBI's suggestion that we should be tossing out our old routers.","rel":"","context":"In &quot;Security&quot;","block_context":{"text":"Security","link":"https:\/\/nccomputertech.com\/techtalk\/category\/security\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/scR199zRjvA\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":9364,"url":"https:\/\/nccomputertech.com\/techtalk\/2018\/06\/03\/this-week-in-tech-669-15-minutes-of-fun\/","url_meta":{"origin":3035,"position":2},"title":"This Week in Tech 669: 15 Minutes of Fun","author":"NCCT","date":"June 3, 2018","format":false,"excerpt":"https:\/\/youtu.be\/KQc0YlNQNfY --Apple's WWDC this week looks like it may be a disappointment for anyone hoping for new hardware. --Facebook is killing its \"Trending Topics\" section. --Teens prefer Instagram and Snapchat to Facebook; close to half are \"almost constantly\" online. --The Atari VCS is coming soon for expensive retro gaming. --Scooters\u2026","rel":"","context":"In &quot;Apple&quot;","block_context":{"text":"Apple","link":"https:\/\/nccomputertech.com\/techtalk\/category\/apple\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/KQc0YlNQNfY\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":9295,"url":"https:\/\/nccomputertech.com\/techtalk\/2018\/02\/05\/this-week-in-tech-652-were-all-out-of-kidneys\/","url_meta":{"origin":3035,"position":3},"title":"This Week in Tech 652: We&#8217;re All Out of Kidneys","author":"NCCT","date":"February 5, 2018","format":false,"excerpt":"https:\/\/youtu.be\/aUpYOMKq4iQ Tech ads in the Superbowl. Elon Musk's \"Not-a-Flamethrower.\" Apple, Google, and Amazon quarterly results. What are Amazon's health plans? What game company will Microsoft buy next?","rel":"","context":"In &quot;Apple&quot;","block_context":{"text":"Apple","link":"https:\/\/nccomputertech.com\/techtalk\/category\/apple\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/aUpYOMKq4iQ\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":9446,"url":"https:\/\/nccomputertech.com\/techtalk\/2018\/12\/03\/friends-in-bikinis-this-week-in-tech-695\/","url_meta":{"origin":3035,"position":4},"title":"Friends in Bikinis &#8211; This Week in Tech 695","author":"NCCT","date":"December 3, 2018","format":false,"excerpt":"https:\/\/youtu.be\/puMBVNv91ZU - Black Friday was Amazon's biggest sales day ever - Marriott Hack hit half a billion Starwood guests for 4 years - Indian Microsoft scammers busted - Amazon's new machine learning racecar, quantum blockchain, and more from re:Invent - When is Amazon rolling out Prime Health? - UK grabs\u2026","rel":"","context":"In &quot;Apple&quot;","block_context":{"text":"Apple","link":"https:\/\/nccomputertech.com\/techtalk\/category\/apple\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/puMBVNv91ZU\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":9320,"url":"https:\/\/nccomputertech.com\/techtalk\/2018\/04\/08\/this-week-in-tech-661-the-ant-man-canon\/","url_meta":{"origin":3035,"position":5},"title":"This Week in Tech 661: The Ant Man Canon","author":"NCCT","date":"April 8, 2018","format":false,"excerpt":"https:\/\/youtu.be\/BOkNYwQ_k1Y Facebook issues the latest in a long string of apologies.YouTube shooter and the lure of fame. Apple plans its own chips for 2020, Mac Pro for 2019. Is Amazon spending too much on video? Terry Myerson out at Microsoft - the end of the Windows era. FBI seizes Backpage.com.","rel":"","context":"In &quot;Apple&quot;","block_context":{"text":"Apple","link":"https:\/\/nccomputertech.com\/techtalk\/category\/apple\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/img.youtube.com\/vi\/BOkNYwQ_k1Y\/0.jpg?resize=350%2C200","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/posts\/3035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/comments?post=3035"}],"version-history":[{"count":0,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/posts\/3035\/revisions"}],"wp:attachment":[{"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/media?parent=3035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/categories?post=3035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nccomputertech.com\/techtalk\/wp-json\/wp\/v2\/tags?post=3035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}