Explore the latest news and trends  

Sign up for our weekly security newsletter

Be the first to receive important updates on security


Zeus-Hosting Russian ISP Taken Offline

PROXIEZ-NET, an Internet Service Provider based in Russia, that cyber-thieves popularly used for stealing logins for online banking is said to have been cut off from the Internet on May 14, 2010 following services severed from DIGERNET, the ISP's upstream provider. PROXIEZ-NET harbored around 13 command-and-control servers of the notorious Zeus Trojan prior to being cut off from DIGERNET.

As per the reports, while PROXIEZ served as the Internet host for keylogging software of hackers as well as for gathering and maintaining stolen data.

Describing the application of keylogging software, the security researchers said that thieves frequently use it for grabbing users' login information for Internet banking. The process includes loading a short code onto a PC that follows every keystroke, after which it transmits the captured data onto the remote attacker's system.

F-Secure's Chief Research Officer, Miko Hypponen, said that it was extremely good to have the latest development. Criminals who were utilizing the ISP to carry out malicious activities were nearly sure to have moved onto another service, he noted. BBC published this on May 17, 2010.

Besides this, Editor Rupert Goodwins of ZDNet UK stated that the shutdown of PROXIEZ-NET represented one more tussle in the battle towards dismembering malicious botnets. According to him, in the case of Zeus, the shutdown helped to disassociate the C&C servers, which coordinated rootkits and Trojans, as per the news published by BBC on May 17, 2010.

Another security response manager Patrick Fitzgerald at security firm Symantec stated that the shutdown implies a favorable attempt vis-à-vis the battle on malware networks like Zeus.

However, according to him, the advantages might not remain for long, as data thieves move onto more supportive ISPs to operate their C&C servers.

The security researchers claimed that several users of PROXIEZ-NET have been running genuine services; consequently, they're now adversely trapped in this fight against malware.

Finally, the latest shutdown brings to mind the shutdown of McColo, the infamous spam host, in 2008. At that time, its 2 key ISPs disconnected it following Security Fix, under the lead of Washington Post reporter Brian Krebs, giving clues that McColo-supported network harbored huge volumes of spam along with other illegal online activities.

Related article: Zeus Trojan Stole Huge Amount of Information

» SPAMfighter News - 5/27/2010

3 simple steps to update drivers on your Windows PCSlow PC? Optimize your Slow PC with SLOW-PCfighter!Email Cluttered with Spam? Free Spam Filter!

Dear Reader

We are happy to see you are reading our IT Security News.

We do believe, that the foundation for a good work environment starts with fast, secure and high performing computers. If you agree, then you should take a look at our Business Solutions to Spam Filter & Antivirus for even the latest version of Exchange Servers - your colleagues will appreciate it!

Go back to previous page