9 Million PCs Compromised by ZeroAccess Botnet

In recent months, the Win32/Sirefef and Win64/Sirefef rootkit family, also known as the ZeroAccess Botnet, has significantly expanded its reach, infecting millions of computers worldwide. This botnet has updated its command and control protocols and now connects to over one million systems globally. Previously, it was noted for creating hidden partitions on hard drives and utilizing alternative data streams to conceal its presence. However, recent changes by its developers have shifted its infection tactics, moving away from kernel-mode components in the latest version. Security firms have been actively monitoring the increase in x64 version infections. SophosLabs has recently uncovered a significant change in the ZeroAccess botnet’s strategy, which now operates entirely in user-mode memory. Two distinct ZeroAccess botnets exist, each featuring both 32-bit and 64-bit versions, resulting in a total of four unique botnets. Each one operates independently, communicating through a specific hard-coded port number embedded in the bot executable.

Surge in ZeroAccess Botnet Infections: 9 Million PCs Compromised

On September 19, 2012, alarming reports surfaced concerning the ZeroAccess botnet, a sophisticated rootkit family identified as Win32/Sirefef and Win64/Sirefef. This malware has undergone significant evolution, effectively updating its command and control protocols to infiltrate an estimated 9 million computers worldwide. This surge in infections highlights the botnet’s ability to connect with over one million hosts globally, raising concerns about cybersecurity across various sectors.

Prominently, the ZeroAccess botnet employs a unique strategy by creating hidden partitions on infected hard drives. It utilizes concealed alternative data streams to maintain its presence, evading detection and enabling it to thrive within target systems. Recent developments indicate that ZeroAccess developers have shifted their tactics, moving away from kernel-mode components in favor of a more user-mode memory operation. Security researchers have observed a concerning trend with the x64 versions of the malware, as evidenced by the findings from SophosLabs, which indicate a significant change in the botnet’s operational framework.

Two distinct variants of the ZeroAccess botnet exist, corresponding to its 32-bit and 64-bit architectures. Each variant operates as a self-contained unit, employing hard-coded port numbers for communication. This isolation contributes to the botnets’ resilience against mitigation efforts, as they do not rely on external networks.

Targeted primarily are personal computers across various demographics—business owners, in particular, may find themselves at risk given the prevalence of this malware in everyday tech environments. The ZeroAccess botnet does not discriminate based on geographical boundaries, posing threats to users regardless of their location. This wide-reaching impact can be distressing for organizations that rely heavily on IT systems for their day-to-day operations and sensitive data management.

In considering the techniques likely employed by the ZeroAccess botnet, several MITRE ATT&CK tactics can be identified. The initial access method appears to encompass social engineering or exploitation of vulnerabilities to gain foothold in targeted systems. Persistence is maintained through the creation of hidden partitions, while privilege escalation remains a key focus for the botnet to ensure prolonged access and control over infected machines.

This culmination of tactics demonstrates how the ZeroAccess botnet not only spreads rapidly but also adapts its infection strategy in response to cybersecurity advancements. Business owners, particularly in the tech-savvy sector, are urged to bolster their defenses through robust security protocols and regular system updates to safeguard against such extensive risks. As incidents involving the ZeroAccess botnet continue to rise, professionals in the cybersecurity space must remain vigilant and proactive in their approach to protecting sensitive data against evolving threats.

Source link