July 26, 2013, 8:42 AM — Microsoft estimates that 88 percent of botnets running the Citadel financial malware were disrupted as a result of a takedown operation launched by the company in collaboration with the FBI and partners in technology and financial services. The operation was originally announced on June 5.
Since then, almost 40 percent of Citadel-infected computers that were part of the targeted botnets have been cleaned, Richard Domingues Boscovich, an assistant general counsel with Microsoft's Digital Crimes Unit, said Thursday in a blog post.
Microsoft did not immediately respond to an inquiry seeking information about how those computers were cleaned and the number of computers that remain infected with the malware.
However, Boscovich said in a different blog post on June 21 that Microsoft observed almost 1.3 million unique IP (Internet Protocol) addresses connecting to a "sinkhole" system put in place by the company to replace the Citadel command-and-control servers used by attackers.
After analyzing unique IP addresses and user-agent information sent by botnet clients when connecting to the sinkhole servers, the company estimated that more than 1.9 million computers were part of the targeted botnets, Boscovich said at the time, noting that multiple computers can connect through a single IP address.
He also said that Microsoft was working with other researchers and anti-malware organizations like the Shadowserver Foundation in order to support victim notification and remediation.
The Shadowserver Foundation is an organization that works with ISPs, as well as hosting and Domain Name System (DNS) providers to identify and mitigate botnet threats.
According to statistics released Thursday by Boscovich, the countries with the highest number of IP addresses corresponding to Citadel infections between June 2 and July 21 were: Germany with 15 percent of the total, Thailand with 13 percent, Italy with 10 percent, India with 9 percent and Australia and Poland with 6 percent each. Five percent of Citadel-infected IP addresses were located in the U.S.
Boscovich praised the collaboration between public and private sector organizations to disrupt the Citadel botnet.
"By combining our collective expertise and taking coordinated steps to dismantle the botnets, we have been able to significantly diminish Citadel's operation, rescue victims from the threat, and make it more costly for the cybercriminals to continue doing business," he said Thursday in the blog post.