Group-IB Helped Identify Dragon Botnet Operator, Leading to Arrest and Takedown
Summary
Group-IB traced the Dragon botnet used for DDoS attacks to its operator, helped law enforcement take down the botnet, and supported an investigation that led to the operator’s arrest, conviction, and suspended sentence in 2012.
Key points
- Dragon was used to launch DDoS attacks against organizations in financial and industrial sectors, including a major bank and Russian industrial company UralMetallCompany.
- Group-IB traced infected devices and examined Dragon malware samples to identify the botnet’s command-and-control server and administrator.
- The operator sold access to the botnet as a DDoS service and advertised attacks on underground forums.
- The botnet used BlackHole exploit-kit activity to install malware on victims’ devices.
- Group-IB passed the suspect’s identity and location to law enforcement; the operator was apprehended in December 2012.
- The operator admitted guilt and received a two-year suspended sentence, while the botnet was taken down.
Article Details
- Event Type
- Investigation and law-enforcement takedown of the Dragon botnet used for DDoS attacks; its operator was arrested, convicted, and sentenced.
- Impact
- The botnet's operations were halted. It had been used to attack banks and other organizations, including Russian industrial company UralMetallCompany; Group-IB estimated the resulting damage could reach tens of thousands of dollars.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | xakepinter[.]net | Underground forum domain where the Dragon botnet malware was offered for sale. |
| DOMAIN | xakepok[.]net | Underground forum domain where the Dragon botnet malware was offered for sale. |
People
Malware
BlackHoleIn the cases seen by Group-IB investigators, the attacker from the town of Sayansk leveraged BlackHole – one of the most popular exploits at the time that exploited security flaws to install malicious software onto aDragonGroup-IB played a crucial role in identifying the individual behind the Dragon botnet, which was responsible for relentless distributed denial-of-service (DDoS) attacks on prominent organizations, including those in the
Vendors
Products
Botnet IntelligenceGroup-IB used proprietary technology that they had developed called Botnet Intelligence for monitoring the infected computers and extracted information about the C2 servers.Group-IB Threat IntelligenceThis product, during 2011 alone, prevented more than 3,000 digital banking thefts and DDoS attacks from legit ISP networks Over the coming years, this product evolved to become Group-IB Threat Intelligence.
Countries
Industries
financialdenial-of-service (DDoS) attacks on prominent organizations, including those in the industrial and financial sectors. Group-IB investigators identified the individual behind the entire enterprise, who wasIndustrialdistributed denial-of-service (DDoS) attacks on prominent organizations, including those in the industrial and financial sectors. Group-IB investigators identified the individual behind the entire enterprise,