• Total Members: 12780
  • Latest: eduard
  • Total Posts: 28039
  • Total Topics: 8052
  • Online Today: 777
  • Online Ever: 51419
  • (01. January 2010., 09:27:49)

Author Topic: FBI & Microsoft destroyed Citadel botnet to pieces !?  (Read 962 times)

0 Members and 1 Guest are viewing this topic.


  • SCF Administrator
  • *****
  • Posts: 7152
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum

The ZeuS-derived Citadel botnet, which rose to public prominence last year, is being progressively disabled by Microsoft and the FBI is on the hunt for its masters.

Microsoft says Citadel was used to raid bank accounts around the world and netted more than $US500m. Redmond's Digital Crimes Unit says 1,000 of the estimated 1,400 botnets created by Citadel have now been booted offline.

According to Reuters, institutions hit by the botnet include American Express, Bank of America, Citigroup, Credit Suisse, eBay's PayPal, HSBC, JPMorgan Chase, Royal Bank of Canada and Wells Fargo:

Citadel, whose capabilities include keylogging, emerged after the source code for the infamous ZeuS cybercrime toolkit was released in 2011. The combination of open source code and forums for virus-writers allowed it to evolve quickly, getting features such as encrypted malware configuration files and blacklisting of security vendor Websites.

Citadel was also designed to be invisible to sites tracking ZeuS – which may help explain why it's had such a long life in the wild.

Microsoft's post concedes that not all of the botnets have been taken down, but Richard Boscovich of the Digital Crimes Unit believes it will “significantly disrupt Citadel's operation”:

It was, Boscovich writes, the first time a botnet operation has involved both the private sector and law enforcement, with the FBI taking a hand to execute a civil seizure warrant to help disrupt the botnet. Data and evidence were seized from data centres in Pennsylvania and New Jersey.

Microsoft has also filed a “John Doe” civil lawsuit in North Carolina against the alleged controller of the botnet, who uses the handle Aquabox and is believed to be in Eastern Europe (partly because Citadel leaves machines in the Ukraine and Russia alone).

The FBI is also working with Europol, along with law enforcement in Australia, Brazil, Ecuador, Germany, Holland, Hong Kong, Iceland, India, Indonesia, Spain and the UK. The international effort is seeking to identify the 81 “herders” who helped Aquabox operate the botnet.

Boscovich writes: “... during our investigation we found that Citadel blocked victims’ access to many legitimate anti-virus/anti-malware sites, making it so people may not have been able to easily remove this threat from their computer. However, with the disruptive action, victims should now be able to access these previously blocked sites.

“We also found that cybercriminals are using fraudulently obtained product keys created by key generators for outdated Windows XP software to develop their malware and grow their business, demonstrating another link between software piracy and global cybersecurity threats. (Of note, Windows Vista, Windows 7 and Windows 8 have measures in place to help protect against this type of misuse of product keys.)”


Samker's Computer Forum -


  • SCF VIP Member
  • *****
  • Posts: 3507
  • KARMA: 152
  • Gender: Female
Re: FBI & Microsoft destroyed Citadel botnet to pieces !?
« Reply #1 on: 09. June 2013., 07:56:59 »
Nice read, Pez-worthy.

I really made the wrong career-choices 20 years ago ;p 500m... :|



~~~ ~~~

Conare nullius momenti videri fortasse missilibus careant
All spelling mistakes are my own and may only be distributed under the GNU General Public License! – (© 95-1 by Coredump; 2-013 by DevNullius)
More information about bitcoin, altcoin & crypto in general? GO TO

Cuisvis hominis est errare, nullius nisi insipientis in errore persevare... So why not get the real SCForum employees to help YOUR troubled computer!!! SCF Remote PC Assist


With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters)

Enter your email address to receive daily email with ' - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising