DNSChanger Malware Ring Dismantled
Today the FBI and NASA’s Office of the Inspector General (NASA-OIG) announced the arrest of six Estonian Criminals who have been involved in creating, developing, propagating a "Pay Per Click" Malware operation.
Apparently, this Malware operation was been active since at least 2007, an is estimated to have infected more than 4 million computers in over 100 countries, including and estimated 500,000 in the US alone.
It is currently estimated that the earnings from Malware generated in excess of 14 Million dollars.
Website Redirection – If you were infected by this malware program, dubbed "DNS Changer", and used a search engine to find legitimate websites, or simply typed in a valid URL, the Malware would redirect you one of the criminals websites instead, earning them a "referral click"
In other examples, traffic to common websites such as the IRS or other government websites was being redirected to a legitimate company with an affiliate program (where the referrer gets both a referral click and an additional commission if the visitor purchased something). This also included re-directing add clicks to other websites than what your visited pages displayed, this happening even without you ever having clicked on any of the adds.
Additionally, you could be redirected to a fake website that looked like the real thing. If you purchased something from this fake site, your credit card would be charged, however, you would never receive what you purchase. Additionally, now that the criminals had your Credit Card number, more fraud would occur, possibly months or years later.
Blocking legitimate Anti-Virus websites – The programs was also noted for blocking access to most major Anti-Virus and Anti-Malware sites to either update existing software, or to download new software.
The Protective Order associated with this case lists the following I/P addresses ranges involved in the fake name-server business.
18.104.22.168 through 22.214.171.124
126.96.36.199 through 188.8.131.52
184.108.40.206 through 220.127.116.11
18.104.22.168 through 22.214.171.124
126.96.36.199 through 188.8.131.52
184.108.40.206 through 220.127.116.11
The FBI has provided a helpful secure document link that explains how to check your DNS settings to see whether you are using one of these "Rogue DNS Servers".
If your IP address is on the list, you are encouraged to fill out a secure form "Register as a Victim of DNS Malware".
The criminals used many different data centers, some of which were featured more prominently in the case than others:
Pilosoft, in New York City known as "The Manhattan Data Center" in the court documents.
ColoSecure, in Chicago, Illinois
ThePlanet, in Houston, Texas
Multacom Corporation, in Canyon County, California
Layered Technologies, in Plano, Texas
Network Operation Center, in Scranton, Pennsylvania
Wholesale Internet, in Kansas City, Missouri
SingleHop, in Chicago, Illinois
PremiaNet, in Las Vegas, Nevada
Interserver, in Secaucus, New Jersey
ISPrime, in Weehawken, New Jersey
Global Net Access, in Atlanta, Georgia
If you suspect that that your system is infected please contact the CCS Retail Systems Support Department