Microsoft offers $250,000 reward for info on Rustock botnet owners

Microsoft has offered a $250,000 bounty for information leading to the arrest of the team behind the Rustock botnet, which was shut down in March.

The reward is for information about the owners of the Rustock botnet, which was estimated to have accounted for half of the world's spam at its height.

Up to 1.6 million PCs were infected, and it took a combined operation between Microsoft, security companies and law enforcement to shut Rustock down by seizing command-and-control servers.

Based on an analysis of the server hard drives, and other documents found, researchers have narrowed the likely location of the botnet controllers to Moscow and St Petersburg.

Microsoft has taken out adverts in local media asking for information, and has issued the Rustock Reward (PDF) to loosen tongues.

"As they say in the intelligence community, you can have all the satellite systems in the world for data, but you still need boots on the ground," Richard Boscovich, senior attorney at the Microsoft Digital Crimes Unit, told V3.co.uk.

"We have a lot of information already, which we can use to weed out false leads, but it's useful to have contacts with personal knowledge that they can bring forward."

The reward money is available to anyone with information. This is the fourth time Microsoft has offered a bounty for malware operators, having paid out for information on the author of the Sasser malware. Microsoft refuses to pay for security vulnerability data.

So far, the Rustock botnet appears to be completely shut down, and half of the PCs infected with the malware have now been cleaned. The takedown followed a similar move against the Waledac botnet, and Microsoft has said it is actively considering new targets.

"Botnets make a lot of money, so I'm not sure how big an effect it will have," Alen Puzic, security researcher at HP's DVLabs, told V3.co.uk.

"But we're seeing more and more botnets, which are much larger and more powerful than before. Governments and commercial companies will need to take a more active role against them."