Iranian Cyber Army moves into botnets

The same group that defaced TechCrunch's website appears to be running a botnet

A group of malicious hackers who attacked Twitter and the Chinese search engine Baidu are also apparently running a for-rent botnet, according to new research.

The so-called Iranian Cyber Army also took credit last month for an attack on TechCrunch's European website. In that incident, the group installed a page on TechCrunch's site that redirected visitors to a server that bombarded their PCs with exploits in an attempt to install malicious software.

Researchers with a security startup called Seculert have traced the malicious server behind those attacks and found indications that the Iranian Cyber Army may also be running a botnet.

They've found an administration interface where people who want to rent the botnet can describe the machines they would like to infect and upload their own malware for distribution by the botnet, said Aviv Raff , CTO and co-founder of Seculert. The company runs a cloud-based service that alerts its customers to new malware, exploits and other cyber threats.

"You provide the number of machines and their region," Raff said. "You then provide the malware download URL, and they will do the malware installation for you."

There are many computer crime gangs that create botnets, or networks of compromised computers, that can then be rented to other players in the cybercrime industry, such as spammers.

Raff said Seculert was able to see the administration panel as it was left unprotected. His company has since notified the provider where the page is hosted and contacted law enforcement.

The Iranian Cyber Army is believed to be behind the botnet since the administration panel showed the same e-mail address that was displayed after the Twitter and Baidu defacement attacks. Also, a page displaying statistics on the number of infected machines showed the group's name in its HTML source code, according to screenshots posted by Seculert.

The statistics page showed that as many as 14,000 PCs were being infected per hour. Since the server has been active since August, Seculert estimates it may have successfully infected as many as 20 million PCs.

The administration console also shows that the exploit kit used to deliver malware has exploits targeting the Java runtime environment, products from Adobe Systems, and Microsoft's operating systems and Internet Explorer browser.

None of the vulnerabilities used by the exploit kit appear to be unknown or, in some cases, even revealed recently. For example, one vulnerability dates from 2006.

"It's scary to see that people are still getting infected because of this vulnerability," Raff said.

The botnet has been used to distribute some of the more notorious malicious software programs including Zeus, which is used to hack into online banking accounts, and the data-stealing Trojans called Gozi and Carberp, Raff said.

An e-mail address links the botnet to earlier attacks claimed by the Iranian Cyber Army.

When Twitter was attacked in December 2009, users were direct to a different website bearing a green flag and the message "This site has been hacked by Iranian Cyber Army," along with the group's supposed e-mail address.

The attack against Twitter, and another against, involved tampering with DNS (Domain Name System) records, which can cause users to be redirected to another website even if the correct domain name is typed.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags securitySeculertmalwarefraud

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Xiro Drone Xplorer V -3 Axis Gimbal & 1080p Full HD 14MP Camera

Learn more >

D-Link TAIPAN AC3200 Ultra Wi-Fi Modem Router (DSL-4320L)

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

ASUS ROG Swift PG279Q – Reign beyond virtual world

Learn more >

Crucial® BX200 SATA 2.5” 7mm (with 9.5mm adapter) Internal Solid State Drive

Learn more >

D-Link PowerLine AV2 2000 Gigabit Network Kit

Learn more >

Gadgets & Things

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >


Learn more >

Family Friendly

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

ASUS VivoPC VM62 - Incredibly Powerful, Unbelievably Small

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Stocking Stuffer

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Best Deals on Good Gear Guide

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.


Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?