After weeklong fight, rogue ISP Troyak struggles for life

Security experts say Troyak provides back-end support for the notorious Zeus malware

After an international take-down effort, a rogue ISP responsible for controlling large numbers of computers infected with data-stealing code is down for the moment, but it may be reconnecting with the Internet, according to security researchers.

Troyak, which is believed to be based in eastern Europe, was knocked offline earlier this month after other networks supplying its connectivity to the Internet stopped carrying its traffic due to complaints it was complicit in cybercrime.

Since then the network has fought a cat-and-mouse game with network providers in 12 countries and international law enforcement, according to Jart Armin, the pseudonymous editor of the Hostexploit.com Web site, which has been involved in the action.

"Troyak is still fighting hard, as it is the only link to the outside Internet for a few [criminal groups]," he said in an e-mail interview.

Troyak and another ISP, Group 3, provided connectivity for 90 of 249 servers used to control Zeus, a sophisticated piece of malware that steals financial credentials and other data. Group 3 has also been disconnected.

At this point, Troyak's reputation is so sullied that it is becoming difficult for it to find other ISPs to carry its traffic on the Internet.

That's an important point, because for Troyak to resume operations, it must find another company or organization that it can peer with in order to be reconnected to the Internet. Currently, even with Troyak offline, there are still 180 Zeus command-and control servers online, Armin said. Most of these are located in Russia and the Ukraine, however, making it easier for security researchers and law enforcement to stay on top of the problem.

"They're being pushed back into their own territory," Armin said.

On Sunday night, Troyak operators apparently hacked into servers in Latvia to get connectivity via an academic network in the country. But that effort was shut down with the help of Latvian law enforcement, Armin said.

On Monday, it appeared Troyak had peered with two upstream providers, wrote Mary Landesman, senior security researcher at ScanSafe, which is owned by Cisco Systems.

But that action appeared to be temporary, and as of Wednesday, Troyak was dead.

"Troyak seems to be down," said an administrator for Zeus Tracker. "And I believe that it won't come up again. Every ISP knows that Troyak is bad and won't peer/route their badness."

But there are signs its operators are making efforts to be reconnected. Computer security experts such as Joze Nazario of Arbor Networks are watching real-time routing tables, which show how Internet traffic is exchanged between ISPs and networks.

An entity called SAINTVPN is now carrying some of the traffic that used to be on Troyak, Nazario said.

SAINTVPN, which lists its location as St. Petersburg, Russia, was set up after the take-down effort and immediately started serving Zeus command-and-control commands, Armin said.

Security experts suspect that Troyak's operators have set up shop under a new name in order to secure a peering agreement with another network that is unaware of the name change.

In theory, it is possible that Troyak's servers could be available through SAINTVPN, but "we don't know if they are shuttered. We don't know if they are trying to find new upstream," Nazario said.

When networks agree to carry each other's traffic, they typically create some business agreement. But it's unknown what sort of business arrangement Troyak may have with SAINTVPN, Nazario said.

"It's an incredibly fluid situation," he said.

According to Armin, the other networks that are still actively hosting core Zeus command-and-control servers are:

AS # Name

49093 BIGNESS-GROUP-AS

24826 KHARKOV-TERMINALS-AS PE

29106 VOLGAHOST-AS PE

50369 VISHCLUB-AS

44557 DRAGONARA

49314 NEVAL PE

13727 ND-CA-ASN

47781 ANSUA-AS PE

29371 GAZTRANZITSTROYINFO-AS

49365 GR-VERTICAL-AS

47434 FORTUNE-AS

47821 BOGONET-AS PE

34305 EUROACCESS

50678 SAINTVPN-AS

"If we get all these, then Zeus will be toothless," Armin said.

Join the PC World newsletter!

Error: Please check your email address.

Tags securityZuesISPmalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?