Notorious Koobface Virus Creators Named, Botnet Shutdown

by John Lister

infopackets.com

You might normally expect hackers to operate in secret, and to communicate through hidden channels. The group behind a notorious social networking virus, however, appears to be actively and publicly posting about the sites which they attack.

Facebook has apparently tracked down what it believes to be a group of five men responsible for the notorious "Koobface" virus and has publicly named them.

So far, the men have not been confirmed as under investigation by law enforcement, nor have they been formally charged. The company says it will publish further details in coming weeks to attempt to identify and stop the perpetrators. (Source: google.com)

It's estimated that between 400,000 and 800,000 PCs were unintentionally infected with the Koobface virus, at its height in popularity of 2010. (Source: zdnet.com)

Hackers Claim Not To Fleece Their Victims

The Koobface virus is directed at users of Facebook, along with users of several other major networking sites.

Koobface is designed to create a network of infected computers without alerting their owners in any way. The hackers use the virus to generate income by delivering rogue advertising to unsuspecting computer users. It's thought those responsible for Koobface have raked in at least $7 million to date.

In its most common form, Koobface sends bogus messages to the online friends of the user with the infected computer. The messages either prompt the recipients to download a software update, or display a link to what's billed as a tantalizing video. If the message recipients click on the offered link, their systems can be hijacked with malware.

At one point, the perpetrators of Koobface posted a message claiming they would only use their illicit network to earn money from third parties, and would never steal (for example, through credit card fraud) from the direct victims of their software virus. (Source: nytimes.com)

Koobface Gang Member Gives Away Location

According to Facebook, the men responsible for Koobface are based in St Petersburg, Russia.

However, they've apparently taken vacations around the world, and at least one of them has posted his location on the Foursquare social network, along with photographs showing other group members at work in an office at that same location.

Some experts believe that the group previously ran some legitimate online businesses, apparently including a website for adults.

Koobface Botnet Shutdown; Social Profiles Deleted

The command and control server responsible for controlling infected PCs has been shut down by its owners. The men named by Facebook as those responsible for the Koobface virus have also deleted their social networking profiles on other sites, according to reports. (Source: zdnet.com)

It remains unclear what role Russian officials will play in the further investigation of these individuals or their possible arrest.