What you need to know
- Microsoft received a federal court order that allowed it to disrupt Trickbot, a dangerous botnet.
- Microsoft's actions disabled IP addresses associated with Trickbot's servers.
- The actions represent a "new legal approach" to fighting these types of attacks.
Microsoft and several organizations worked together to stop a hacking operation that could potentially threaten the upcoming U.S. election if left unchecked (via CNN). Microsoft's efforts disrupt a botnet known as Trickbot, which is a dangerous botnet that is utilized by criminals to distribute ransomware.
Microsoft highlights in a blog post that experts believe ransomware is one of the largest threats to the upcoming U.S. elections. Ransomware can be used to lock computer systems used as part of the election, such as devices that maintain voter rolls or systems that report election results.
To disrupt Trickbot, Microsoft received a federal court order that allowed the company to disable IP addresses associated with Trickbot's services. Microsoft worked with telecommunication partners around the world to execute its plans. Microsoft's actions happen alongside efforts by US Cyber Command to disrupt cyber criminals, as explained by the Washington Post.
Microsoft analyzed approximately 61,000 samples of Trickbot malware during its investigation. Trickbot provides "malware-as-a-service," which means that the people behind Trickbot can provide people access to infected machines. This allows people to deliver malware, including ransomware, to infected devices. In addition to infecting PCs, Trickbot has also infected IoT devices.
"We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems," explains Microsoft corporate vice president Tom Burt.
These efforts represent a "new legal approach," according to Microsoft. The company also notes that criminals will likely be able to adapt and find new ways to proceed with plans. The new approach could then be used to help fight against adapted attacks going forward.
Burt explains in Microsoft's blog post,
We fully anticipate Trickbot's operators will make efforts to revive their operations, and we will work with our partners to monitor their activities and take additional legal and technical steps to stop them.
Disrupting Trickbot will also help protect financial services institutions, government agencies, healthcare facilities, businesses, and universities from malware attacks that are enabled by Trickbot.
