{"id":35830,"date":"2014-06-04T09:11:41","date_gmt":"2014-06-04T16:11:41","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=35830"},"modified":"2025-08-17T22:50:01","modified_gmt":"2025-08-18T05:50:01","slug":"zeus-cryptolocker-game-over","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/zeus-cryptolocker-game-over\/","title":{"rendered":"Massive Law Enforcement Operation Tells two Malware Variants it\u2019s Game Over"},"content":{"rendered":"

On Monday, the United States Department of Justice<\/a> announced an international law enforcement effort to take out a massive botnet<\/a>\u2014a network of infected personal computers that work together to accomplish a task given by a hacker. This botnet was particularly nasty because it delivered two programs to victims: Gameover Zeus<\/a>, a hidden program that siphoned passwords used to log onto banking websites, and Cryptolocker<\/a>, a program notorious for rendering a victim\u2019s computer inoperable until a ransom has been paid.<\/p>\n

The effort, dubbed \u201cOperation Tovar,\u201d has so far been a success. That success is largely thanks to the efforts of international law enforcement agencies and private organizations (including McAfee<\/a>) operating in tandem to impact the communications infrastructure of the criminals, but also provide tools for consumers to remove the malware from infected systems.<\/p>\n

But, this nasty online threat won\u2019t be offline forever. This is why it is imperative that you should run the removal tool on your computer, do not ignore it or wait to fix your infected computer.<\/strong> That\u2019s because the network of hackers responsible for the infections will try their best to regain control of the botnet.<\/p>\n

Whether you receive a notification or not, it is imperative that you test whether your device is infected with the free McAfee stinger tool<\/a>.<\/p>\n

So how did cybercriminals manage to infect so many computers in the first place? Well, the criminals infected computers through two methods\u2014one focused on businesses, and one focused more on consumers:<\/p>\n

First, with Gameover Zeus, cybercriminals took advantage of web browser weaknesses to compromise a victim\u2019s computer. These attacks often stemmed from spear phishing<\/a>, a type of well-targeted attack that tricks users into unknowingly infecting their systems with malware. Spear phishing attacks vary from regular phishing attacks as they are much more targeted in nature (hence the name). With spear phishing, cybercriminals aim to infect a particular person or company rather than blindly casting out a wide net hoping to catch any victim they can. Once cybercriminals gained access to user\u2019s machines through successful spear phishing attempts, they were able to steal passwords, banking information, and more.<\/p>\n

Second, with Cryptolocker, cybercriminals used emails with attachments purporting to be a voicemail or shipping confirmation\u2014a more classic phishing attack example. Cryptolocker was less focused on enterprise extortion, more focused on the individual consumer. This difference can be seen in the number of successfully infected computers and illegal gains illustrated below. Once cybercriminals installed Cryptolocker on a user\u2019s machine, they were able to lock the user out of their own computer\u2014demanding a ransom for access to personal files or threatening that they be encrypted and lost forever.<\/p>\n

According to the Department of Justice, Gameover Zeus, which infected anywhere between 500,000 to 1 million computers, is responsible for an estimated $100 million in losses to U.S. businesses. Its nefarious companion, Cryptolocker, is allegedly responsible for infecting about 234,000 computers and creating $27 million in losses. These are serious pieces of malware, wreaking serious havoc.<\/p>\n

And unfortunately, they may not be out of commission for long. The criminal network operating the botnet will be working overtime to regain control of their illegal property. And, in all likelihood, they will soon get it back.<\/p>\n

Tips to Protect Yourself From These Malware Variants<\/h2>\n

So what can you do to protect yourself from these two nasty malware variants? Well, here\u2019re a few tips:<\/p>\n