Pleased with their good work, the Federal Bureau of Investigation has released details on their takedown of the Gameover Zeus botnet:
The Gameover Zeus botnet owners looked at their operation as a complete criminal organization, owned all the assets and put them all under one roof, Elliott noted. “They were very centralized, which made it good for them from a logistics standpoint and very good for us in law enforcement.”
One of the principal servers used by Gameover Zeus was referred to by the botnet owners as the “Business Club.” Through the Business Club, the FBI was able to connect the dots across attacks and victims. There was a full ledger system in place that kept accurate track of all the fraud committed by the Gameover Zeus botnet, Elliott said.
As to how the FBI actually identified the individuals responsible, Elliott said the criminals weren’t part-time criminals; cybercrime was their full-time job. That’s how the FBI was able to identify Evgeniy Bogachev as the kingpin behind the Gameover Zeus botnet.
“One of the things we try to do as law enforcement is work ourselves in, so we can attack the seams between their personal life and their criminal life,” Elliott said. “Fortunately Bogachev was a user of VPNs, and he liked to use the same VPNs to log into his personal accounts as he would to administrate the backend of the botnet servers.”
The FBI did a botnet takeover in June of 2014 to protect victims and stop future fraud.