Botnets are immune and impossible to disconnect

It was found that there is a dedicated network that keeps most notorious botnets always-on connections and virtually immune from takedowns. Researchers at RSA have identified the network of the servers that shepherd tens of thousands of infected PCs so they continue to send spam, spread malware, and stay updated with the latest bot software.

The cyber crooks behind the networks maintain numerous connections between these master control channels and the outside world which allows them to arrange a highly resistant networks which are almost impossible to shut down for the authorities.

"What they've worked really hard to do for themselves is build a spiderweb of connections to the outer ring if the outer ring were the internet at large," Sean Brady, manager of RSA's identity protection and verification group, told. "As you start picking off threads, they work to reroute, to crawl along different threads."

During the analysis the researchers found how it was that an ISP known as AS-Troyak was able to reconnect to the internet shortly after two of its upstream providers severed its ties. It is absolutely natural that cyber crooks won’t allow authorities or anyone else so easily to disconnect them entirely as they invested too heavily in infecting machines across the globe.

The research reveals that there are eight networks dedicated to keeping ISPs such as Troyak connected no matter what may happen:

Citygame, AS12604

Vishclub, AS50369

Smila, AS50390

Mariam UA, AS42229

Prombuddetal, AS44107

VVPN, AS49934

Vesteh, AS47560, and

Bogonet, AS47821

Surrounding these networks are the ISPs that host the command and control channels. Besides Troyak, they include:

Profitlan, AS12383

Taba, AS8287

Smallshop, AS31366, and

Ya, AS44051

Thus, these ISPs are provided with the connection by nine upstream ISPs that are believed to be law-abiding businesses. When by any chance these ISPs disconnect (as Ihome and Oversun-Mercury are believed to have done last week) Troyak and the other four networks can fall back on the bulletproof hosts, which have their own upstream providers

This is exactly what Troyak just some time after it was unplugged. This way Zeus-related bots were able to continue their operation.