{"id":5634,"date":"2015-04-13T08:30:22","date_gmt":"2015-04-13T12:30:22","guid":{"rendered":"http:\/\/kasperskydaily.com\/uk\/?p=5634"},"modified":"2020-02-26T15:11:06","modified_gmt":"2020-02-26T15:11:06","slug":"simda-botnet-check","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/simda-botnet-check\/5634\/","title":{"rendered":"Is your PC a part of botnet? Check it!"},"content":{"rendered":"<p>Many people still think that malware is a software that completely disrupts normal functioning of PCs. If your computer is working tip-top, it means it\u2019s not infected, right? Wrong. Malware creators are not your bored cyber-cowboys anymore. The main goal of cybercriminals is not to make a cyber-badaboom just for kicks, but to earn money. In many cases this goal dictates completely opposite behaviour of malware: the best one is the least visible to users.<\/p>\n<p>\u00a0<\/p>\n<p>For instance, such \u2018stealth\u2019 behaviour is often typical for <a href=\"https:\/\/www.kaspersky.co.uk\/blog\/botnet\/\" target=\"_blank\" rel=\"noopener\">botnets<\/a>. Usually they consist of thousands of PCs, and if we\u2019re talking about hugest ones, it\u2019s hundreds of thousands of PCs. Owners of these computers don\u2019t have any clues that they are infected. All they can see is that PC works a bit slower, which is not unusual for PCs in general.<\/p>\n<p>Botnets are designed to gather personal data including passwords, social security numbers, credit card details, addresses and telephone numbers. This data may be used in crimes including identity theft, various types of fraud, spamming, and other malware distribution. Botnets can also be used to launch attacks on websites and networks.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Kaspersky along with Intel and ShadowServer help to bring down the Beebone botnet \u2013 <a href=\"http:\/\/t.co\/xCOKx49m7B\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/xCOKx49m7B<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/586293791436447744?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">April 9, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>It always takes a lot of efforts of many cooperating parties to shut down the large botnet. Recent example is Simda botnet, which is believed to have infected more than 770,000 computers in more than 190 countries. The most affected countries are the US, UK, Turkey, Canada and Russia.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/86\/2015\/04\/05195420\/botnet-simda-countries.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-5636\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/86\/2015\/04\/05195420\/botnet-simda-countries.png\" alt=\"botnet-simda-countries\" width=\"654\" height=\"399\"><\/a><\/p>\n<p>Simda is, as one can say, \u2018vending botnet\u2019 used to distribute illicit software and different types of malware, including those capable of stealing financial credentials. Creators of the specific malicious programs were simply paying Simda owners fee per each install. In other words, this botnet was a kind of huge trade chain for malware \u2018manufacturers\u2019.<\/p>\n<p>The botnet was active for years. To make malware more effective, Simda owners were working hard on new versions, generating and distributing them as frequently as every few hours. At the moment, Kaspersky Lab\u2019s virus collection contains more than 260,000 executable files belonging to different versions of Simda malware.<\/p>\n<p><strong><blockquote class=\"twitter-pullquote\"><p>Is your PC a part of huge #Simda #botnet? Check it!<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2FPU9T&amp;text=Is+your+PC+a+part+of+huge+%23Simda+%23botnet%3F+Check+it%21\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote><\/strong><\/p>\n<p>A simultaneous take-down of 14 command and control servers of Simda botnet located in the Netherlands, US, Luxembourg, Russia and Poland was carried out on Thursday 9 April.<\/p>\n<p>The list of organisation involved in this shut down operation perfectly illustrates its complexity. INTERPOL, Microsoft, Kaspersky Lab, Trend Micro, Cyber Defense Institute, FBI, Dutch National High-Tech Crime Unit (NHTCU), Police Grand-Ducale Section Nouvelles Technologies in Luxembourg, and Russian Ministry of the Interior\u2019s Department \u2018K\u2019 were working together to counteract the cybercriminals.<\/p>\n<p><strong>https:\/\/twitter.com\/INTERPOL_HQ\/status\/587470291108024320<\/strong><\/p>\n<p>\u201cBotnets are geographically distributed networks and it is usually a challenging task to take down such a thing. That\u2019s why the collaborative effort of both private and public sectors is crucial here \u2013 every party makes its own important contribution to the joint project,\u201d said Vitaly Kamluk, Principal Security Researcher at Kaspersky Lab, and currently on secondment to INTERPOL. \u201cIn this case, Kaspersky Lab\u2019s role was to provide technical analysis of the bot, collect botnet telemetry from the Kaspersky Security Network and advise on takedown strategies.\u201d<\/p>\n<p>As investigation is still ongoing, it is too early to tell who is behind the Simda botnet. What is important for us, users, is that as a result of the disruption operation, command and control servers used by criminals to communicate with infected machines have been shut down. Although the Simda botnet operation is suspended, people whose PCs were infected should get rid of this malware as soon as possible.<\/p>\n<p>Using information retreived from Simda botnet command and control servers Kaspersky Lab has created <a href=\"https:\/\/kas.pr\/Z7JK\" target=\"_blank\" rel=\"noopener noreferrer\">a special page where you can check<\/a>, if your computer\u2019s IP address is in the list of infected ones.<\/p>\n<div id=\"attachment_5637\" style=\"width: 1034px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/86\/2015\/04\/05195419\/simda-check.jpg\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-5637\" class=\"size-large wp-image-5637\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/86\/2015\/04\/05195419\/simda-check-1024x520.jpg\" alt=\"https:\/\/checkip.kaspersky.com\" width=\"1024\" height=\"520\"><\/a><p id=\"caption-attachment-5637\" class=\"wp-caption-text\">https:\/\/checkip.kaspersky.com<\/p><\/div>\n<p>Another option to make sure everything\u2019s all right with your PC is to use a free <a href=\"https:\/\/www.kaspersky.co.uk\/advert\/free-trials?redef=1&amp;THRU&amp;reseller=gb_socmed_ups_ona_smm__onl_b2c_som_sma_______\" target=\"_blank\" rel=\"noopener\">Kaspersky Security Scan<\/a> tool or download 3-month valid trial version of our more powerful solution, <a href=\"https:\/\/www.kaspersky.co.uk\/advert\/free-trials\/multi-device-security?redef=1&amp;THRU&amp;reseller=blog_en-gb\" target=\"_blank\" rel=\"noopener\">Kaspersky Internet Security<\/a>. Of course, all Kaspersky Lab solutions detect Simda malware. More information on Simda botnet is available at <a href=\"https:\/\/securelist.com\/blog\/69580\/simdas-hide-and-seek-grown-up-games\/\" target=\"_blank\" rel=\"noopener\">Securelist<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently Interpol, Microsoft and Kaspersky Lab revealed and shut down a huge botnet which zombified about 770,000 of PCs worldwide. Check this story out and then check your PC.<\/p>\n","protected":false},"author":421,"featured_media":5635,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2026],"tags":[392,973,584,347,974,36,97,972],"class_list":{"0":"post-5634","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-botnet","9":"tag-check","10":"tag-great","11":"tag-interpol","12":"tag-ksn","13":"tag-malware-2","14":"tag-security-2","15":"tag-simda"},"hreflang":[{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/simda-botnet-check\/5634\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/simda-botnet-check\/4751\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/simda-botnet-check\/3321\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/simda-botnet-check\/5781\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/simda-botnet-check\/7489\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/simda-botnet-check\/8304\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/simda-botnet-check\/7327\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/simda-botnet-check\/7489\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/simda-botnet-check\/8304\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/simda-botnet-check\/8304\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.uk\/blog\/tag\/botnet\/","name":"botnet"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/5634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/users\/421"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=5634"}],"version-history":[{"count":3,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/5634\/revisions"}],"predecessor-version":[{"id":19210,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/5634\/revisions\/19210"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media\/5635"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=5634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=5634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=5634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}