Media Coverage

Shadowserver in the news

FBI in Alaska just thanked Qihoo 360 for helping combat cyber crime

TechNode, December 14, 2017

FBI Anchorage in Alaska just showed its appreciation on Twitter to Qihoo 360, the leading Chinese cybersecurity company providing anti-virus solutions, for its role in cracking three local cyber crime cases involving significant DDOS attacks. Local FBI has tweeted out an appreciation note, saying that “#FBIAnchorage would like to thank our business partners in this case: 360.CN, AT&T, Dyn, Paterva, Paypal and ShadowServer.”

BrickerBot Author Retires Claiming to Have Bricked over 10 Million IoT Devices

Bleeping Computer, December 11, 2017

The author of the BrickerBot malware has announced his retirement in an email to Bleeping Computer, also claiming to have bricked over 10 million devices since he started the “Internet Chemotherapy” project in November 2016.

Global law enforcement operation decimates giant Andromeda botnet

SC Magazine, December 5, 2017

An international contingent of law-enforcement agencies on Friday dismantled the massive Andromeda malware botnet, sinkholing around 1,500 malicious domains and arresting a suspect in Belarus.

Andromeda Botnet Shut Down

PC Mag, December 4, 2017

Andromeda has been active at least since 2011, and was notorious for infecting computers around the globe to form a botnet. With the help of partners—including the FBI, Microsoft, and others—Europol intercepted the internet traffic between Andromeda-infected computers and the command servers to which the malware was communicating. All that traffic was then “sinkholed” and redirected to servers under the investigators’ control, giving law enforcement a detailed view of the malware’s activities. “Andromeda was also sometimes used to download up to 80 other malware families onto infected victim computers,” according to The Shadowserver Foundation, a group of security experts that also helped dismantle the Andromeda botnet.

How the FBI took down Russia's Spam King - and his massive botnet

Wired, November 4, 2017

The Justice Department announced Monday that it had successfully targeted a man prosecutors called “one of the world’s most notorious criminal spammers,” a Russian hacker known as Peter Yuryevich Levashov, also known as Peter Severa, or “Peter of the North.” Levashov had long run the Kelihos botnet, a global network of infected computers that collectively flooded email inboxes worldwide with spam, stole banking credentials from infected users, and spread malware across the internet.

Suspended Sentence for Mirai Botmaster Daniel Kaye

Brian Krebs, July 28, 2017

Last month, KrebsOnSecurity identified U.K. citizen Daniel Kaye as the likely real-life identity behind a hacker responsible for clumsily wielding a powerful botnet built on Mirai, a malware strain that enslaves poorly secured Internet of Things (IoT) devices for use in large-scale online attacks. Today, a German court issued a suspended sentence for Kaye, who now faces cybercrime charges in the United Kingdom.

Taking down Avalanche, a case study in international cooperation

SC Magazine, July 26, 2017

Grasso described to the crowd how it took the efforts of the FBI, German federal police, Ukrainian law enforcement, U.S. CERT, ShadowServer and other companies to bring down Avalanche.

FBI Talks Avalanche Botnet Takedown

Dark Reading, July 26, 2017

BLACK HAT USA – Las Vegas – Tom Grasso, unit chief of the FBI’s cyber division, took the Black Hat stage to discuss the processes and partnerships leading up to the massive Avalanche takedown in December 2016.

CERT Australia takes over ACMA cyber security program

Computer World, July 3, 2017

Responsibility for the Australian Internet Security Initiative (AISI) has shifted been from the Australian Communications and Media Authority to CERT Australia from 1 July. Responsibility for the Australian Internet Security Initiative (AISI) has shifted been from the Australian Communications and Media Authority to CERT Australia from 1 July. The data is drawn from a range of sources, including Microsoft, the Spamhaus Project and the Shadowserver Foundation.

74 countries hit by NSA-powered WannaCrypt ransomware backdoor: Emergency fixes emitted by Microsoft for WinXP+

The Register, May 13, 2017

Special report The WannaCrypt ransomware worm, aka WanaCrypt, WannaCry or Wcry, today exploded across 74 countries, infecting hospitals, businesses including Fedex, rail stations, universities, at least one national telco, and more organizations. “IP addresses from our sinkhole have been sent to FBI and ShadowServer so affected organisations should get a notification soon,”