Alert (TA15-098A) AAEH

ronjor · Apr 9, 2015

Original release date: April 09, 2015

Systems Affected

Microsoft Windows 95, 98, Me, 2000, XP, Vista, 7, and 8
Microsoft Server 2003, Server 2008, Server 2008 R2, and Server 2012

Overview

AAEH is a family of polymorphic downloaders created with the primary purpose of downloading other malware, including password stealers, rootkits, fake antivirus, and ransomware.

The United States Department of Homeland Security (DHS), in collaboration with Europol, the Federal Bureau of Investigation (FBI) and the Department of Justice (DOJ), released this Technical Alert to provide further information about the AAEH botnet, along with prevention and mitigation recommendations.
Click to expand...

https://www.us-cert.gov/ncas/alerts/TA15-098A

Dermot7 · Apr 9, 2015

On 8 April, Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce (J-CAT), joined forces with the Dutch authorities and the FBI, and U.S-based representatives at the National Cyber Investigative Joint Task Force- International Cyber Crime Coordination Cell (IC4) along with private sector partners, to target the Beebone (also known as AAEH) botnet, a polymorphic downloader bot that installs various forms of malware on victims’ computers. Initial figures show that over 12 000 computers have been infected, however it is likely there are many more.
Click to expand...

https://www.europol.europa.eu/conte...-operation-targets-polymorphic-beebone-botnet

https://blogs.mcafee.com/mcafee-labs/takedown-stops-polymorphic-botnet

Several global law enforcement agencies—with assistance from Intel Security—this week successfully dismantled the “Beebone” botnet behind a polymorphic worm known by Intel Security as W32/Worm-AAEH. The purpose of this worm is to facilitate downloading other malware, including ZBot banking password stealers, Necurs and ZeroAccess rootkits, Cutwail spambots, fake antivirus, and ransomware. The worm spreads quickly to new machines and contains a cyclic update routine to replace itself with newer versions that increase the likelihood the worm will remain undetected by security software.
Click to expand...

Dermot7 · Apr 21, 2015

On April 8, the takedown operation for the polymorphic botnet known as Beebone successfully concluded. This action redirected traffic from infected hosts to a sinkhole operated by the Shadowserver Foundation. In addition to halting additional infections and the continued morphing of the W32/Worm-AAEH worm, the sinkhole allows McAfee Labs and other partners in the takedown to better understand the scope and complexity of the Beebone operation. We now have a more accurate count of infected hosts, we have identified additional indicators of compromise, and we have greater visibility into the botnet’s geographic reach.
Click to expand...

Update on the Beebone Botnet Takedown - McAfee

Log in or Sign up

Alert (TA15-098A) AAEH

ronjor Global Moderator

Dermot7 Registered Member

Dermot7 Registered Member

Log in or Sign up

Alert (TA15-098A) AAEH

ronjor Global Moderator

Dermot7 Registered Member

Dermot7 Registered Member

Useful Searches