Microsoft has won a battle to permanently disrupt a haven for the Nitol botnet that it discovered within an Internet domain controlled by a Chinese ISP.
The company has signed a private settlement that Peng Yong and Changzhou Bei Te Kang Mu Software Technology Co., Ltd., will block all connections to designated malicious subdomains of the 3322.org domain controlled by Peng and Bei Te Kang Mu Software.
Microsoft has identified those subdomains as hosting command and control servers for the Nitol botnet, which enlists infected machines into botnets that can execute distributed denial-of-service (DDoS) attacks and can also download malicious code for machines to perform whatever commands the bot commander directs.
Traffic to those 3322.org subdomains will be directed to sinkholes run in cooperation with either Microsoft or the China CERT (CN-CERT), according to the agreement, and log information about the computers trying to connect to the subdomains will be shared with CN-CERT. The designated subdomains will be de-registered as well, the agreement states.
Peng and Changzhou Bei Te Kang Mu Software agree to try to help find owners of the machines trying to make connections and to help the owners remove malware from the computers, the agreement says. In addition, Peng and his business will post a public policy asserting zero tolerance for illegal activity in the 3322.org domain.
Microsoft had won a temporary restraining order giving it control of 3322.org, and the agreement says it will return that control to Peng.
Microsoft came across the Nitol refuge when it was following up on a case of new computers being sold in China with pirated Microsoft software and Nitol malware preinstalled. It won a U.S. court order to gain control of 3322.org until Peng could respond to a lawsuit filed by Microsoft against him. Part of the agreement is that Microsoft will drop the suit.
