Spanish investigators have arrested three alleged ringleaders of the so-called "Mariposa" botnet, which had infected and controlled up to 12.7m PCs, including more than 500 of the US Fortune 1,000 companies and more than 40 major banks.
The PCs, running Microsoft Windows, were spread among 190 countries, and infected by a computer virus that allowed the ringleaders to steal credit card details and online banking credentials, as well as sensitive data from the hard drives of the machines.
The Spanish authorities worked with a number of private computer security companies, including Panda Security and Defense Intelligence, to track down the alleged controllers of the botnet, which seems to have been started in December 2008 and was first detected in May 2009. More arrests are expected in other countries.
The arrests are significant because the masterminds behind the biggest botnets are not often taken down. And the suspects are not the stereotypical genius programmers often associated with cybercrime. Instead, they had underworld contacts who helped them to build and operate the botnet, Cesar Lorenza, a captain with Spain's Guardia Civil, which is investigating the case, told the Associated Press.
Investigators are examining bank records and seized computers to determine how much money the criminals made.
"They're not like these people from the Russian mafia or Eastern European mafia who like to have sports cars and good watches and good suits. The most frightening thing is they are normal people who are earning a lot of money with cybercrime," Lorenza said.
The three suspects, who were not named, were described as Spanish citizens with no criminal records. They face up to six years in prison if convicted of hacking charges.
Spanish authorities identified them by their internet "handles" and their ages: "netkairo", 31; "jonyloleante", 30; and "ostiator", 25.
Botnets are networks of infected PCs that have been hijacked from their owners, often without their knowledge, and put into the control of criminals. Linked together, the machines supply an enormous amount of computing power to spammers, identity thieves, and internet attackers, who can mount "denial of service" attacks against companies – or blackmail them by threatening to block them at crucial times.
The Mariposa botnet, which has been dismantled, was easily one of the world's biggest. Christopher Davis, CEO for Defence Intelligence, who first discovered the Mariposa botnet, said: "It would be easier for me to provide a list of the Fortune 1000 companies that weren't compromised, rather than the long list of those who were."
Davis said he noticed the infections when they appeared on networks of some of his firm's clients, including pharmaceutical companies and banks. But it was several months later before he realized the infections were part of something much bigger.
After seeing that some of the servers used to control computers in the botnet were located in Spain, Davis and researchers from the Georgia Tech Information Security Center joined with software firm Panda Security, which is headquartered in Bilbao, Spain.
Critically, one suspect made direct connections from his own computer seeking to reclaim control of his botnet after authorities took it down. Investigators were able to identify him based on that traffic, and were able to back up their claims with records from domains he registered where he would eventually host malicious content.
It turned out that the people behind the botnet – its "runners" – had infected computers by instant-messaging malicious links to contacts on infected computers. They also uploaded viruses onto removable thumb drives and through peer-to-peer networks. The program used to create the botnet was known as Mariposa, from the Spanish word for "butterfly."
"I don't think there's anything about this guy that makes him smarter than any of the other botnet guys, but the (Mariposa) software, it's very professional, it's very effective," said Pedro Bustamante, senior research adviser with Panda Security. "It came alive and started spreading and it got bigger than him."
But, he added: "Our preliminary analysis indicates that the botmasters did not have advanced hacking skills. This is very alarming because it proves how sophisticated and effective malware distribution software has become, empowering relatively unskilled cyber criminals to inflict major damage and financial loss."
While arrests of people accused of running smaller botnets are fairly common, the biggest botnet leaders are rarely caught. That's partly because it's easy for criminals to hide their identities by disguising the source of their internet traffic. Often, every computing resource they use is stolen.
For instance, there have been no arrests – nor even any public idenfication of suspects – in the spread of the Conficker worm, which was set up in November 2008 and infected between 3m and 12m Windows PCs, causing widespread fear that it could be used as a kind of internet super-weapon.
The Conficker botnet is still active, but is closely watched by security researchers. The infected computers have so far been used to make money in standard ways for such infected machines – pumping out spam and spreading fake antivirus software.