Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Who's Behind the Koobface Botnet? - An OSINT Analysis
From: Dancho Danchev <dancho.danchev () gmail com>
Date: Mon, 9 Jan 2012 07:02:06 -0800

Hi everyone,

In this post, I will perform an OSINT analysis, exposing one of the
key botnet masters behind the infamous Koobface botnet, that I have
been extensively profiling and infiltrating since day one. I will
include photos of the botnet master, his telephone numbers, multiple
email addresses, license plate for a BMW, and directly connect him
with the infrastructure -- now offline or migrated to a different
place -- of Koobface 1.0.

The analysis is based on a single mistake that the botnet master made
- namely using his personal email for registering a domain parked
within Koobface's command and control infrastructure, that at a
particular moment in time was directly redirecting to the ubiquitous
fake Youtube page pushed by the Koobface botnet.


Dancho Danchev
Cyber Threats/CyberCrime Analyst | Security Blogger, ZDNet at CBS
Interactive | Securiy Blogger at Webroot
Personal Blog: http://ddanchev.blogspot.com
ZDNet Blog: http://blogs.zdnet.com/security
Webroot Blog: http://blog.webroot.com
Twitter: http://twitter.com/danchodanchev
LinkedIn: http://nl.linkedin.com/in/danchodanchev
Facebook: http://facebook.com/dancho.danchev
Skype ID: dancho_danchev_

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]