Necurs botnet
The Necurs botnet is a distributor of many pieces of malware, most notably Locky.[1]
Reports
[edit]Around June 1, 2016, the botnet went offline,[2] perhaps due to a glitch in the command and control server running Necurs. However, three weeks later, Jon French from AppRiver discovered a spike in spam emails, signifying either a temporary spike in the botnet's activity or return to its normal pre-June 1 state.[3][4]
In a 2020 report, it was noted to have particularly targeted India, Southeast Asia, Turkey and Mexico.[5]
2020 disruption
[edit]On March 5, 2020, a judge of the United States District Court for the Eastern District of New York authorized Microsoft to take control of the US-based infrastructure used by Necurs. The botnet was believed to have infected more than 9 million computers worldwide. Partners in 35 countries took part in the operation.[6][7]
Microsoft also worked out about 6 million domain names the botnet was likely to use over the next two years. It reported them so that authorities in the affected countries could block them.[7] The US court orders were executed at five US-based registries while 22 country code top-level domain registries acted voluntarily.[7][8] As of March 2020, an estimated 2 million computers were still infected.[6]
Distributed malware
[edit]Source:[9]
See also
[edit]References
[edit]- ↑ Abrams, Lawrence (June 23, 2016). "Necurs Botnet returns with new Locky Ransomware Campaign". BleepingComputer. Retrieved October 30, 2026.
- ↑ "One of the World's Largest Botnets Has Vanished". Motherboard. Vice. June 8, 2016. Retrieved October 30, 2026.
- ↑ French, Jon (27 June 2016). "Necurs BotNet Back With A Vengeance Warns AppRiver". Retrieved 27 June 2016.
- ↑ "Pump and dump spam: Incapta Inc (INCT)". Retrieved 22 Mar 2017.
- ↑ "Microsoft Hijacks Necurs Botnet that Infected 9 Million PCs Worldwide". The Hacker News.
- 1 2 Waldman, Arielle (March 11, 2020). "Microsoft leads takedown of Necurs botnet". TechTarget SearchSecurity. Retrieved October 30, 2026.
- 1 2 3 "Microsoft strikes back at Necurs botnet by preemptively disabling hacking tools". CyberScoop. March 10, 2020. Retrieved October 30, 2026.
- ↑ "Has The Sun Set On The Necurs Botnet?". The Shadowserver Foundation. March 15, 2020. Retrieved October 30, 2026.
- ↑ "Hackers behind Locky and Dridex start spreading new ransomware". Retrieved 27 June 2016.
 | This malware-related article is a stub. You can help Wikipedia by adding missing information. |