Microsoft is claiming a total victory at least for this round over the ZeroAccess bot-herders whose criminal network was the target of a joint effort among Microsoft, the FBI, Europol and a group of security vendors.
"I am pleased to report that our disruption effort has been successful, and it appears that the criminals have abandoned their botnet," writes Richard Boscovich, assistant general counsel of Microsoft's Digital Crimes Unit, in the Official Microsoft Blog.
+ Also on Network World: 'ZeroAccess' click-fraud botnet disrupted, but not dead yet | Microsoft: No Ballmer replacement until next year +
Bot-herders literally signaled their abandonment with a white flag. Part of a message sent to infected computers was "WHITEFLAG", "which we believe symbolizes that the criminals have decided to surrender control of the botnet," Boscovich writes. "Since that time, we have not seen any additional attempts by the bot-herders to release new code and as a result, the botnet is currently no longer being used to commit fraud."
The company has also dropped its civil suit against the criminals (listed as John Does in court papers) in order to give law enforcement officials free rein to pursue them, Boscovich writes.
Getting the bot-herders to walk away from their network wasn't part of the plan two weeks ago when the takedown was executed through a court order that allowed Microsoft to take control of domain names linked to the botnet and to block command and control traffic to infected computers. Similar actions were taken by Europol in five European countries.
At the time of the takedown, Microsoft said, "Microsoft and its partners do not expect to fully eliminate the ZeroAccess botnet due to the complexity of the threat. However, Microsoft expects that this action will significantly disrupt the botnet's operation."
Boscovich says that within 24 hours of the disruption, the bot-herders pushed new instructions to infected computers so they could continue their illegal work, but those messages were traced to their source IP addresses, which were then shut down. The final messages sent to the zombie machines included the word WHITEFLAG, he says.
Microsoft says ZeroAccess, also known as Sirefef, disables security software that might be running on victim computers, making it difficult to get rid of. Microsoft offers help here.
Tim Greene covers Microsoft and unified communications for Network World and writes the Mostly Microsoft blog. Reach him at tgreene@nww.com and follow him on Twitter@Tim_Greene.
Read more about wide area network in Network World's Wide Area Network section.