ISP takedown hamstrings Zeus malware

The Zeus Trojan has gained notoriety among the security community

Security firms chalked up a victory on Wednesday with the takedown of dozens of malware botnets.

Kazakhstan-based service provider Troyak was shut down on Tuesday night, crippling six smaller ISPs which were helping to run botnets based on the Zeus malware infection.

A coalition of six anonymous security firms convinced host companies of Troyak to shut down the firm's systems, an act which took down the command and control servers for 68 of the 249 known Zeus botnets, including the network used to steal $415,000 (£277,000) from Bullitt County, Kentucky.

The takedown could deal a significant blow to the criminals running Zeus. The malware has become notorious among security firms owing to its ease of use and ability to inject code directly into otherwise legitimate files.

Cisco ScanSafe security researchers Henry Stern and Mary Landesman told V3.co.uk that, while the takedown may not by itself have a long-term impact on numbers, the tactic of pressuring legitimate host companies to cut ties with shady service providers and botnet operators could pay big dividends in the fight against cyber crime.

"A bot is very cheap, but a router and a server are very expensive," explained Stern.

Security firms are also hoping that, by outing the companies that provide services for criminal activity, larger firms will crack down on their clients in order to preserve their corporate reputations.

"It can have a deterring impact because you're forcing a rise in the cost of doing business," said Landesman. "When you go after the high level, it creates a financial impact for these legit companies."