By Lester Haines for The
Register.
This article has been reproduced with permission.
The three men, a 63-year-old from England, a 19-year-old from
Finland and a 28-year-old from Scotland, are being questioned after
computers were "seized at residential addresses in both countries
in addition to the suspects' servers".
A Metropolitan Police statement reads: "This highly organised
group are suspected of writing new computer viruses in order to
avoid detection by anti-virus products. They have been primarily
targeting UK businesses since at least 2005, and during this time
thousands of computers are known to have been infected across the
globe."
Detective Constable Bob Burls, of the Metropolitan Police
Computer Crime Unit, added: "These men appear to be connected via
an online company. We believe the suspects created and adapted
viruses with the aim of causing massive infection by spamming.
Today's arrests will send a clear worldwide signal to the authors
of malicious software that national borders will not limit the
ability and commitment of law enforcement authorities to clamp down
on this criminal activity."
The virus in question is, according to CNet, called either
"Ryknos", "Breplibot" or "Stinkx", and is delivered when
unsuspecting users click on an attachment to an email which
reads:
"Hello, Your photograph was forwarded to us
as part of an article we are publishing for our December edition of
Total Business Monthly. Can you check over the format and get back
to us with your approval or any changes? If the picture is not to
your liking then please send a preferred one. We have attached the
photo with the article here. Kind regards, Jamie Andrews."
The "Breplibot" virus has previously been fingered for
exploiting Sony-BMG's infamous rootkit DRM technology, and was
delivered via a similar email.
The rootkit masked any files beginning with "$sys$", and
Breplibot accordingly used this handy facility to drop the file
"$sys$drv.exe" into the Windows system directory safe from the
prying eyes of anti-virus software.
© The Register
2006
