Taking apart a botnet ...

rslade — Mon, 09 Oct 2023 09:06:14 GMT

The FBI is messing with Joanap, a botnet run by a major North Korean blackhat group.

Joanap itself is fairly complicated, with infections being started by an SMB worm, which then installs the Joanap RAT (Remote Access Trojan). Command and control is done via a peer-to-peer distributed network.

Which is where the FBI comes in. A court in the US granted them permission to set up fake servers pretending to be controllers on Joanap. As such, they could spy on individual machines, collect information, or even install software (possibly to remove the infections and patch vulnerabilities).

In examining the ethics of active defence, I find this fascinating.

I'm pretty sure than in Canadian law the FBI action would actually be illegal, which is possibly why they are contacting host governments in the cases of non-US victims.

(Oh, and remember to patch your systems, which is the only reason the blackhats were able to build Joanap in the first place ...)

topic Taking apart a botnet ... in Industry News

Taking apart a botnet ...