Arbor Networks Shuts Down Dutch Botnet Attack; Arbor Networks Works with Dutch Network Security Authorities to Shut Down Malicious Botnet Attacks against Broadband Sites in The Netherlands

Business Wire, March 13, 2006

LEXINGTON, Mass. -- Arbor Networks has tracked and helped shut down a malicious botnet that was trying to wreak havoc against broadband sites hosted in the Netherlands. As part of its global intelligence and monitoring efforts, Arbor Networks tracks malicious, network-based behaviour, and works with authorities to immobilize destructive activities at the source.

The Arbor security team decoded the botnet on March 1, 2006 and after logging its activities, correlated a series of distributed denial of service (DDoS) attacks against broadband sites hosted in the Netherlands as having emanated from the network of compromised hosts. The Arbor security team then contacted the Dutch Computer Emergency Response Team (CERT), GOVCERT.NL, the next day and provided them with all the gathered intelligence to assist in the shutdown of the botnet.

Bot software often employs the Internet Relay Chat (IRC) network protocol to communicate. The IRC server - likely a compromised host - that was used in these attacks resides on a network hosted in the Netherlands. During the Arbor security team's analysis of the botnet, data was discovered suggesting that the botnet "controller" was either an individual or group of individuals who spoke Dutch, and were employing Arabic-named IRC channels, usernames and passwords to control the botnet.