Microsoft takes control of ransomware botnet amid US election threat

Microsoft said on Monday it had used a court order to take control of computers that were installing ransomware and other malicious software on local government networks and threatening to disrupt the November US election.

The maker of the Windows operating system said it seized a series of IP addresses hosted by US companies that had been directing activity on computers infected with Trickbot, one of the most common pieces of malware.

More than a million computers have been infected with Trickbot, and the operators use the software to install more pernicious programs, including ransomware, for both criminal groups and national governments that pay for the access, researchers said.

Trickbot has shown up in a number of public governments, which could be hurt worse if the operators encrypt files or install programs that interfere with voter registration records or the display and public reporting of election results, Microsoft said.

“Ransomware is one of the largest threats to the upcoming election,” said Microsoft corporate vice president Tom Burt. Among other programs, Trickbot has been used to deliver Ryuk ransomware, which has been blamed in attacks on the city of Durham, North Carolina, and hospitals during the Covid-19 pandemic.

Microsoft worked with Broadcom’s Symantec, security firm ESET and other companies to dissect Trickbot installations and trace them to the command addresses, the companies said. Microsoft for the first time used strict provisions in copyright law to convince a federal judge in the Eastern District of Virginia that since Trickbot used Microsoft code, the company should be able to seize the operator’s infrastructure from their unknowing hosting providers.

The seizure follows mechanical attempts to disrupt Trickbot last week by sending the operators bad information, researchers said. The Washington Post reported that US Cyber Command was behind that effort, also aimed at cutting off possible sources of election chaos. Cyber Command did not respond to a request for comment.

A parallel FBI investigation identified three Eastern Europeans with major roles in the group behind Trickbot, according to one person working with the government in the matter. The person had expected indictments to be unsealed today, but said that step might have been delayed. A US justice department spokesman did not respond to messages seeking comment over the weekend.

Microsoft said the legal seizures and its deals with telecommunications providers would stop Trickbot from deploying new software or activating pre-installed ransomware.

But Symantec said Trickbot has control points in at least 20 countries, none of which are bound by the US court order. For that reason, the group running the compromised machines is likely to regroup and may be able to communicate with infected computers in America, if less smoothly than before.  — Reported by Joseph Menn, with additional reporting by Chris Bing, (c) 2020 Reuters