An Inside Look at the Russian Business Network

A new white paper published by the nonprofit botnet-tracker Shadowserver Foundation sheds some light on one segment of activity on the Russian Business Network (RBN).

Shadowserver released its findings on malware associated with the so-called AS40989 group of interconnected IP networks on the RBN. Shadowserver gathered nearly 3,000 sample pieces of malware -- including Gozi, Goldun, Hupigon, Nurech, Nuklus, Pinch, Sinowal, Tibs, Xorpix, as well as dialers, downloaders, worms, adware, page hijackers, and proxies -- that communicated with the AS40989 network via HTTP connections.

Security experts say RBN -- which recently disappeared off the Internet in what could be a retrenching move -- serves as an ISP and hosting service for Websites that deal in spam, identity theft, and other illegal activities. RBN in an interview with Wired last fall said that it's misunderstood, and denied wrongdoing.

Shadowserver observed in its research on RBN that RBN malware hosts appear to be professionally managed. "By 'professional' it is meant that rarely are malware back-ends misconfigured or open to inspection and, rarely do they generate errors or move from host to host," according to the report.