Ajay Kumar: Created a new article

2023-09-25T18:42:41Z

Created a new article

New page

{{Short description|Computer botnet}}
The '''Mariposa botnet''', discovered December 2008,<ref name=telegraph>{{cite news|url=https://www.telegraph.co.uk/technology/7913767/FBI-arrests-mastermind-of-Mariposa-botnet-computer-code.html |title=FBI arrests 'mastermind' of Mariposa botnet computer code |work=[[The Daily Telegraph]]|date=28 July 2010|accessdate=29 July 2010| location=London}}</ref> is a [[botnet]] mainly involved in [[Confidence trick|cyberscamming]] and [[denial-of-service attack]]s.<ref name=washingtontimes>{{cite web|first=Ali |last=Zerdin|url=http://www.washingtontimes.com/news/2010/jul/28/cyber-mastermind-arrested-questioned-in-slovenia/ |title=Cyber mastermind arrested, questioned in Slovenia |work=[[The Washington Times]]|location=Washington, D.C. |date=28 July 2010 |accessdate=29 July 2010}}</ref><ref name=canada>{{cite web|url=http://www2.canada.com/topics/technology/story.html?id=3333655 |title=Suspected 'Mariposa Botnet' creator arrested |work=[[Postmedia News|canada.com]] |date=28 July 2010 |accessdate=29 July 2010 |url-status=dead |archive-url=https://web.archive.org/web/20110511115226/http://www2.canada.com/topics/technology/story.html?id=3333655 |archive-date=May 11, 2011 }}</ref> Before the botnet itself was dismantled on 23 December 2009, it consisted of up to 12 million unique IP addresses or up to 1 million individual [[zombie computer]]s infected with the "Butterfly (''mariposa'' in Spanish) Bot", making it one of the largest known botnets.<ref name=canada/><ref name=defintel>{{cite web|first=Matt |last=Thompson |url=http://www.defintel.com/docs/Mariposa_Analysis.pdf |title=Mariposa Botnet Analysis |work=[[Defence Intelligence (company)|Defintel]] |date=7 October 2009|accessdate=29 July 2010}}</ref><ref name=krebs1>{{cite web|first=Brian |last=Krebs |url=http://krebsonsecurity.com/2010/05/accused-mariposa-botnet-operators-sought-jobs-at-spanish-security-firm/ |title=Accused Mariposa Botnet Operators Sought Jobs at Spanish Security Firm |accessdate=14 October 2014}}</ref>

== History ==

=== Origins and initial spread ===
The botnet was originally created by the DDP Team ([[Spanish language|Spanish:]] ''Días de Pesadilla Team'', [[English language|English:]] ''Nightmare Days Team''), using a [[malware]] program called "Butterfly bot", which was also sold to various individuals and organisations.<ref name=washingtontimes/><ref name=nzherald>{{cite web|url=http://www.nzherald.co.nz/technology/news/article.cfm?c_id=5&objectid=10661891 |title=FBI says cyber mastermind nabbed|work=[[The New Zealand Herald]]|date=28 July 2010 |accessdate=29 July 2010}} {{Dead link|date=October 2010|bot=H3llBot}}</ref> The goal of this malware program was to install itself on an uninfected PC, monitoring activity for passwords, bank credentials and credit cards.<ref name=washingtontimes/> After that the malware would attempt to self-propagate to other connectible systems using various supported methods, such as [[Windows Live Messenger|MSN]], [[Peer-to-peer|P2P]] and [[USB]].<ref name=symantec>{{cite web|first=Peter |last=Coogan |url=http://www.symantec.com/connect/blogs/mariposa-butterfly-bot-kit |title=The Mariposa/Butterfly Bot Kit|work=[[NortonLifeLock|Symantec]]|date=7 October 2009|accessdate=29 July 2010}}</ref>

After completing its initial infection routine the malware would contact a [[Botnet#Command_and_control|command-and-control server]] within the botnet. This command and control server could be used by the controllers of the botnet, in order to issue orders to the botnet itself.<ref name=pandalabs>{{cite web|first=Luis |last=Corrons |url=http://pandalabs.pandasecurity.com/mariposa-botnet/ |title=Mariposa botnet|work=[[Panda Security]]|date=3 March 2010|accessdate=29 July 2010}}</ref>

=== Operations and impact ===
The operations executed by the botnet were diverse, in part because parts of the botnet could be rented by third party individuals and organizations.<ref>{{cite web|work=Help Net Security |url=http://www.net-security.org/secworld.php?id=8962 |title=Massive Mariposa botnet shut down |date= 3 March 2010|accessdate=29 July 2010}}</ref> Confirmed activities include [[denial-of-service attack]]s, [[e-mail spam]], theft of personal information, and changing the search results a browser would display in order to show advertisements and pop-up ads.<ref name=pandalabs/><ref name=krebsonsecurity>{{cite web|url=http://krebsonsecurity.com/2010/03/mariposa-botnet-authors-may-avoid-jail-time/ |title='Mariposa' Botnet Authors May Avoid Jail Time|work= Krebs on Security |date=4 March 2010 |accessdate=29 July 2010|first=Brian |last=Krebs}}</ref>

Due to the size and nature of a botnet its total financial and social impact is difficult to calculate, but initial estimates calculated that the removal of the malware alone could cost "tens of millions of dollars".<ref name=pandalabs/><ref name=reuters>{{cite news|url=https://www.reuters.com/article/idUSN0218881320100302 |title=Spain busts ring accused of infecting 13 mln PCs |publisher=Reuters |date= 2010-03-02|accessdate=2010-07-29}}</ref> After the apprehension of the botnet's operators government officials also discovered a list containing personal details on 800,000 individuals, which could be used or sold for [[Identity theft]] purposes.<ref name=reuters/>

The countries most infected by the botnet were India, Mexico, Brazil and South Korea.<ref>{{cite web |title=13m users worldwide affected by Mariposa botnet |url=https://www.helpnetsecurity.com/2010/03/10/13m-users-worldwide-affected-by-mariposa-botnet/ |website=Help Net Security |date=10 March 2010}}</ref>

=== Dismantling ===
In May 2009 the Mariposa Working Group (MWG) was formed as an informal group, composed of [[Defence Intelligence (company)|Defence Intelligence]], the [[Georgia Tech Information Security Center]] and [[Panda Security]], along with additional unnamed security researchers and law enforcement agencies. The goal of this group was the analysis and extermination of the Mariposa botnet itself.<ref name=pandalabs/>

On 23 December 2009 the Mariposa Working Group managed to take control of the Mariposa Botnet, after seizing control of the [[Botnet#Command_and_control|command-and-control servers]] used by the botnet. The operational owners of the botnet eventually succeeded in regaining control over the botnet, and in response launched a [[denial-of-service attack]] on Defence Intelligence.<ref name=pandalabs/> The attack itself managed to knock out Internet connectivity for a large share of the ISP's customers, which included several Canadian universities and government agencies.<ref>{{cite news|last=Larraz |first=Teresa |url=https://www.reuters.com/article/idUSTRE6214ST20100303 |title=UPDATE 1-Spain busts ring accused of infecting 13 mln PCs|work=[[Reuters]] |date= 3 March 2010|accessdate=29 July 2010}}</ref>

On 3 February 2010, the [[Civil Guard (Spain)|Spanish national police]] arrested Florencio Carro Ruiz (alias: Netkairo) as the suspected leader of the DDP Team. Two additional arrests were made on 24 February 2010. Jonathan Pazos Rivera (alias: Jonyloleante) and Juan José Ríos Bellido (alias: Ostiator) were arrested on the suspicion of being members of DDP.<ref name=canada/><ref name=pandalabs/><ref name=thetechherald>{{cite web|first=Steve |last=Ragan |url=http://www.thetechherald.com/article.php/201009/5330/Mariposa-botnet-12-7-million-bots-strong-knocked-offline |title=Mariposa botnet – 12.7 million bots strong – knocked offline |work=The Tech Herald |date=3 March 2010 |accessdate=29 July 2010 |url-status=dead |archive-url=https://web.archive.org/web/20100725032024/http://www.thetechherald.com/article.php/201009/5330/Mariposa-botnet-12-7-million-bots-strong-knocked-offline |archive-date=25 July 2010 }}</ref><ref name=wtopnews>{{cite web|url=http://www.wtopnews.com/?sid=2013636&nid=108 |title=Cyber mastermind arrested, questioned in Slovenia|work=[[WTOP-FM]] |accessdate=29 July 2010}} {{Dead link|date=December 2013}}</ref><ref>{{cite web|url=https://www.fbi.gov/news/pressrel/press-releases/fbi-slovenian-and-spanish-police-arrest-mariposa-botnet-creator-operators|title=FBI, Slovenian and Spanish Police Arrest Mariposa Botnet Creator, Operators|location=Washington, D.C.|date=28 July 2010|work=[[Federal Bureau of Investigation|FBI National Press Office]]|accessdate=27 December 2013}}</ref>

On 18 July 2010, Matjaž Škorjanc (alias: Iserdo), the creator of the "Butterfly bot" malware, was arrested in [[Maribor]] by [[Slovenian police]] for the first time,<ref>{{cite news |url=http://www.rtvslo.si/crna-kronika/fbi-potrdil-aretacijo-stajerskega-hekerja-ta-ze-na-prostosti/235675 |title=FBI potrdil aretacijo štajerskega hekerja; ta že na prostosti |language=sl|trans-title=FBI Confirms the Arrest of the Styrian Hacker; He Is Already at Large |date=28 July 2010}}</ref> but released due to lack of evidence. He was arrested again in October 2011.<ref>{{cite news |url=http://www.delo.si/novice/kronika/afera-mariposa-skorjanc-se-ni-zelel-zagovarjati.html |title=Afera Mariposa: Škorjanc se ni želel zagovarjati |newspaper=Delo.si |language=sl|date=6 August 2012 |trans-title=Mariposa Affair: Škorjanc Refuses to Defend Himself}}</ref> In December 2013 Škorjanc was convicted in Slovenia of "creating a malicious computer program for hacking information systems, assisting in wrongdoings and money laundering."<ref>{{cite news|title=Creator of Mariposa Botnet Sentenced to 58 Months in Prison|date=23 December 2013|work=Security Week|url=http://www.securityweek.com/creator-mariposa-botnet-sentenced-58-months-prison|accessdate=27 December 2013}}</ref> He was sentenced to 4 years and 10 months imprisonment and fined [[Euro|€]]3,000 ($3,000).<ref>{{cite news|title=Hacker sentenced for 'malicious' programme|work=IOL|url=http://www.iol.co.za/scitech/technology/security/hacker-sentenced-for-malicious-programme-1.1626367|date=24 December 2013|accessdate=27 December 2013}}</ref> The court also ordered the seizure of Škorjanc's property acquired with the proceeds of crime.<ref>{{cite news|title=Mariposa botnet 'mastermind' jailed in Slovenia|date=24 December 2013|work=[[BBC News]]|url=https://www.bbc.co.uk/news/technology-25506016|accessdate=27 December 2013}}</ref> After he appealed the verdict his fine was in February 2015 raised for additional 25,000 EUR.<ref>{{cite news|url=http://www.sta.si/vest.php?id=2100646|title=Mariposa Botnet Hacker Fails with Appeal at Higher Court|date=5 February 2015|archive-url=https://archive.today/20150308094953/http://www.sta.si/vest.php?id=2100646|archive-date=2015-03-08|url-status=dead|publisher=Slovenian Press Agency}}</ref>

On 5 June, 2019, US law enforcement opened a new case in the operations of the Mariposa (Butterfly Bot, BFBOT) malware gang. FBI has moved forward with new charges and arrest warrants against four suspects including [[NiceHash]]'s operator Matjaž Škorjanc.<ref>{{Cite news|url=https://www.zdnet.com/article/eight-years-later-the-case-against-the-mariposa-malware-gang-moves-forward-in-the-us/|title=Eight years later, the case against the Mariposa malware gang moves forward in the US|date=2019-06-11|work=ZDNet|access-date=2019-06-11|language=en-US}}</ref>

== References ==
{{Reflist|30em}}

== External links ==
*[http://defintel.com/docs/Mariposa_Analysis.pdf Analysis of the Mariposa botnet]

{{Botnets}}
{{Hacking in the 2000s}}
{{Hacking in the 2010s}}

{{DEFAULTSORT:Mariposa Botnet}}
[[Category:Internet security]]
[[Category:Distributed computing projects]]
[[Category:Spamming]]
[[Category:Botnets]]
[[Category:Cybercrime in India]]

Mariposa botnet - Revision history

Ajay Kumar: Created a new article