Kelihos Followup: Microsoft Dismisses Civil Case Against Some Defendants

Last month we brought you news about Operation b79, the Project MARS investigation by Microsoft’s Digital Crimes Unit that took down the Kelihos botnet, and led to a civil case against the alleged leader, Dominique Alexander Piatti, and his company the dotFREE Group SRO, a Czech domain name registrar corporation.

As you may recall, this was the third such action from Microsoft, but the first time that a named defendant was identified and served with a lawsuit.  A little more than a month after the joint operation that included members of the Trustworthy Computing Team and the Malware Protection System, a settlement has been reached between Microsoft and Kyrus Tech as plaintiffs, and Mr. Piatti and his company as defendants.

During the investigation, it was determined that the command and control systems of the Kelihos botnet resided in domains under the cz.cc domain controlled by dotFREE Group SRO. Microsoft and Kyrus Tech were able to obtain a temporary restraining order to shut down the servers controlling the botnet, which effectively ended a system of over 41,000 compromised computers responsible for sending up to 3.8 billion spam messages per day.

After reviewing evidence gathered from dotFREE Group SRO, it became clear that neither Mr. Piatti nor his company were directly responsible for, or involved in, the Kelihos botnet. The twenty-two John Doe defendants named in the original complaint apparently were using subdomains under the cz.cc domain to conduct their illegal actions without the cooperation or knowledge of Piatti or his company. The use of subdomains to host phishing sites, malware, and c&c systems is a growing problem. Research found that instances of using subdomains nearly doubled last year and continue to climb, with domains in China and Korea being the most commonly used.

While Microsoft has moved to dismiss the complaint against Mr. Piatti and the dotFREE Group SRO, this is not the end of their involvement. The former defendants have agreed to either delete, or to  transfer to Microsoft’s control all of the subdomains involved with the Kelihos botnet. Richard Boscovich, senior attorney for Microsoft’s Digital Crimes Unit, stated that Piatti and his company will continue to work with Microsoft to “become a role model for the free domain industry, establishing industry best practices in the subdomain space.”

Mr. Boscovich indicated that Microsoft will continue to press legal action against the remaining twenty-two John Doe co-defendants.