US disrupts botnets accused of hijacking cameras, routers to attack victims worldwide ...

ANCHORAGE, Alaska (KTUU) - Federal authorities say they have disrupted four major networks — known as botnets — blamed for massive distributed denial-of-service attacks, including some that reached a record-breaking 30 terabits per second and affected victims worldwide, including the Department of Defense’s information network.

The operation, announced Thursday by the U.S. Attorney’s Office for the District of Alaska, targeted command-and-control infrastructure tied to the Aisuru, KimWolf, JackSkid and Mossad Internet of Things botnets.

U.S. officials said the action happened in coordination with law enforcement operations in Canada and Germany that also targeted people linked to the networks.

During the U.S. portion of the operation, the Defense Criminal Investigative Service executed seizure warrants for multiple U.S.-registered internet domains, virtual servers and other infrastructure that authorities allege was used in cyber-enabled crime, including distributed denial-of-service (DDoS) attacks against IP addresses owned by the Department of Defense Information Network, or DoDIN.

Investigators say the four botnets together infected more than 3 million of devices worldwide as of March, including hundreds of thousands in the United States. Many of the compromised devices were internet-connected consumer products such as digital video recorders, web cameras and Wi-Fi routers.

According to court documents, the botnet operators used the infected devices to carry out hundreds of thousands of denial-of-service attacks against computers and servers around the world. Authorities say the operators also sold access to the hijacked devices to other criminals in a “cybercrime as a service” model, allowing customers to use the networks to launch attacks of their own.

Officials said some victims reported tens of thousands of dollars in losses and cleanup costs. In some cases, authorities said, the attacks were accompanied by extortion demands.

Court documents cited by officials allege that the Aisuru botnet issued more than 200,000 DDoS attack commands, the KimWolf botnet issued more than 25,000, the JackSkid botnet more than 90,000 and the Mossad botnet more than 1,000.

The Justice Department said the operation was intended to disrupt communications tied to the botnets, prevent additional infections and reduce the networks’ ability to launch future attacks.

“Today, the United States joined international law enforcement partners in coordinated enforcement actions to disrupt DDoS threats impacting Alaskans and victims around the world,” U.S. Attorney Michael J. Heyman for the District of Alaska said in a statement.

Rebecca Day, special agent in charge of the FBI Anchorage Field Office, said the case underscored the importance of cooperation among U.S. and international investigators.

“By working closely with DCIS and our international law enforcement partners, we collectively identified and disrupted criminal infrastructure used to carry out largescale DDoS attacks,” Day said.

German and Canadian authorities carried out related operations targeting botnet administrators and infrastructure, according to the release. The Justice Department also credited a long list of private-sector and nonprofit partners with assisting in the investigation.

The Defense Criminal Investigative Service is investigating the case with assistance from the FBI Anchorage Field Office. Assistant U.S. Attorney Adam Alexander is prosecuting the matter.

See a spelling or grammar error? Report it to web@ktuu.com