In late 2011, the FBI released documents and data focusing on “Operation Ghost Click.” This malicious operation, leveraging a variety of DNSChanger-type malware, was defined by the FBI as an “international cyber ring that infected millions of computers.”
Associated malware samples and events can be traced back several years, and multiple platforms were targeted. To this day many remain affected or infected and are still open to compromise.
The amount of helpful data around this issue is plentiful. Even the FBI has provided a tool to check whether your host/IP is affected.
https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS
So, fast-forward to the present: Within McAfee Labs we have been flooded with queries (forgive the DNS pun) on what will happen on March 8, and what other impacts might ripple through our environments as the FBI takes the next steps toward concluding Operation Ghost Click.
The Good News!
On March 5, a U.S. District Court in New York signed an order to extend the March 8 deadline to July 9.
This extension will allow all affected entities to continue to track down and remediate against hosts that are still compromised. Current data indicates that there are still several million infected or affected hosts worldwide.
Also, as a handy reminder, the offensive Netblocks are well documented:
- 67.210.0.0 through 67.210.15.255
- 93.188.160.0 through 93.188.167.255
- 77.67.83.0 through 77.67.83.255
- 213.109.64.0 through 213.109.79.255
- 64.28.176.0 through 64.28.191.255
To learn more about how to maintain your online connection and to protect against this malware family, read our new Threat Advisory:
https://kc.mcafee.com/corporate/index?page=content&id=PD23652
For McAfee Customers: Detection for associated malware is provided under the DNSChanger Trojan family.
For example: http://www.mcafee.com/threat-intelligence/malware/default.aspx?id=141841
Other Resources:
- McAfee Labs Security Advisory MTIS11-219
- McAfee Labs Threat Advisory on DNSChanger
- McAfee Labs DNSChanger Description Search
- The FBI’s DNSChanger Malware
- United States District Court Southern District of New York Post-Indictment Protective Order extending the March 8 date. (Click on image to expand.)
Court-ordered date extension