# Kelihos botnet

**en.wikipedia.org/wiki/Kelihos_botnet**

Contributors to Wikimedia projects

Jump to navigation Jump to search
The Kelihos botnet, also known as Hlux, is a [botnet mainly involved in spamming and the](https://en.wikipedia.org/wiki/Botnet)
theft of [bitcoins.[1]](https://en.wikipedia.org/wiki/Bitcoin)

## History


The Kelihos botnet was first discovered around December 2010.[2] Researchers originally
[suspected having found a new version of either the Storm or](https://en.wikipedia.org/wiki/Storm_botnet) [Waledac botnet, due to](https://en.wikipedia.org/wiki/Waledac)
[similarities in the modus operandi and](https://en.wikipedia.org/wiki/Modus_operandi) [source code of the bot,[3][4]](https://en.wikipedia.org/wiki/Source_code) but analysis of the botnet
[showed it was instead a new, 45,000-infected-computer-strong, botnet that was capable of](https://en.wikipedia.org/wiki/Trojan_horse_(computing))
sending an estimated 4 billion spam messages a day.[5][6] In September 2011[7] [Microsoft](https://en.wikipedia.org/wiki/Microsoft)
took down the botnet in an operation codenamed "Operation b79".[5][8] At the same time,
Microsoft filed civil charges against Dominique Alexander Piatti, dotFREE Group SRO and
22 [John Doe defendants for suspected involvement in the botnet for issuing 3,700](https://en.wikipedia.org/wiki/John_Doe)
[subdomains that were used by the botnet.[8][9]](https://en.wikipedia.org/wiki/Subdomains) These charges were later dropped when
Microsoft determined that the named defendants did not intentionally aid the botnet
controllers.[10][11]

In January 2012 a new version of the botnet was discovered, one sometimes referred to as
Kelihos.b or Version 2,[1][6][7] consisting of an estimated 110,000 infected computers.[1][12]
During this same month Microsoft pressed charges against Russian citizen Andrey
Sabelnikov, a former IT security professional, for being the alleged creator of the Kelihos
Botnet [sourcecode.[11][13][14]](https://en.wikipedia.org/wiki/Sourcecode) The second version of the botnet itself was shut down by it in
[March 2012 by several privately owned firms by sinkholing it – a technique which gave the](https://en.wikipedia.org/wiki/DNS_sinkhole)
companies control over the botnet while cutting off the original controllers.[2][15]


Following the shutdown of the second version of the botnet, a new version surfaced as early
as 2 April, though there is some disagreement between research groups whether the botnet
is simply the remnants of the disabled Version 2 botnet, or a new version altogether.[16][17]
This version of the botnet currently consists of an estimated 70,000 infected computers. The
Kelihos.c version mostly infects computers through Facebook by sending users of the
[website malicious download links. Once clicked, a Trojan horse named Fifesoc is](https://en.wikipedia.org/wiki/Trojan_horse_(computing))
[downloaded, which turns the computer into a zombie, which is part of the botnet.[18]](https://en.wikipedia.org/wiki/Zombie_(computer_science))

On 24 November 2015 a Kelihos botnet event occurred causing widespread false positives
of blacklisted IPs:


-----

November 24, 2015 Widespread false positives

Earlier today, a very large scale Kelihos botnet event occurred - by large scale, many
email installations will be seeing in excess of 20% kelihos spam, and some will see
their inbound email volume jump by a volume of as much as 500%. This isn't an
unusual thing normally, the CBL/XBL has been successfully dealing with large scale
Kelihos spam spikes like this, often daily, for years.

The email was allegedly from the US Federal Reserve, saying something about
restrictions in "U.S. Federal Wire and ACH online payments." Not only was the notice
itself fraudulent, the attached Excel spreadsheet (.xls) contained macro instructions (a
downloader) to download a Windows executable virus, most likely Dyreza or Dridex
malware.


The detection rules initially deployed by the CBL unfortunately were insufficiently
detailed, and listed a number of IP addresses in error.″[19]

[An affidavit unsealed on 5 February 2018, showed Apple's unexpected role in bringing the](https://en.wikipedia.org/wiki/Apple_Inc.)
[Russian spam king to justice. Peter Levashov allegedly ran the Kelihos botnet under the](https://en.wikipedia.org/wiki/Peter_Levashov)
alias "Severa", renting out access to spammers and other cybercriminals. But despite
Levashov's significant efforts at anonymity, court records show that federal agents had been
[surveilling his iCloud account since 20 May 2016, funneling back crucial information that may](https://en.wikipedia.org/wiki/ICloud)
have led to his arrest. The standing federal iCloud warrant would have given authorities a
[running tab of IP addresses used to log in to the account, which could easily have tipped](https://en.wikipedia.org/wiki/IP_address)
them off to his vacation in [Barcelona, Spain, and was arrested at the request of US law](https://en.wikipedia.org/wiki/Barcelona)
enforcement and extradited to the United States for prosecution.[20]

## Structure, operations and spread


[The Kelihos botnet is a so-called peer-to-peer botnet, where individual botnet nodes are](https://en.wikipedia.org/wiki/Peer-to-peer)
capable of acting as command-and-control servers for the entire botnet. In traditional nonpeer-to-peer botnets, all the nodes receive their instructions and "work" from a limited set of
servers – if these servers are removed or taken down, the botnet will no longer receive
instructions and will therefore effectively shut down.[21] Peer-to-peer botnets seek to mitigate
that risk by allowing every peer to send instructions to the entire botnet, thus making it more
difficult to shut down.[2]

[The first version of the botnet was mainly involved in denial-of-service attacks and](https://en.wikipedia.org/wiki/DDoS#Distributed_attack) email
[spam, while version two of the botnet added the ability to steal Bitcoin wallets, as well as a](https://en.wikipedia.org/wiki/Bitcoin)
[program used to mine bitcoins itself.[2][22]](https://en.wikipedia.org/wiki/Bitcoin#Mining) Its spam capacity allows the botnet to spread itself
[by sending malware links to users in order to infect them with a Trojan horse, though later](https://en.wikipedia.org/wiki/Malware)
versions mostly propagate over social network sites, in particular through Facebook.[16][23] A
mo[24] re comprehensive list of the Kelihos spam can be found in the following research paper.


-----

U.S. v. Levashov Search Warrant (Unsealed)

## Arrest and extradition

On 2 February 2018, the [United States Department of Justice announced that a Russian](https://en.wikipedia.org/wiki/United_States_Department_of_Justice)
[national has been extradited from Spain and will be arraigned in Connecticut on charges](https://en.wikipedia.org/wiki/Spain)
stemming from his alleged operation of the Kelihos botnet. Peter Yuryevich Levashov, 37,
also known as Pyotr Levashov,[25] Petr Levashov, Peter Severa, Petr Severa and Sergey
[Astakhov, of St. Petersburg, was detained on 7 April 2017 in Barcelona, when he was](https://en.wikipedia.org/wiki/Barcelona)
arrested by Spanish authorities based upon a criminal complaint and arrest warrant issued in
the United States District of Connecticut.[26] On 3 February 2018, he pleaded not guilty to the
[charges of wire and email fraud,](https://en.wikipedia.org/wiki/Mail_and_wire_fraud) [hacking,](https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#Criminal_offenses_under_the_Act) [identity theft and](https://en.wikipedia.org/wiki/Identity_theft_in_the_United_States) [conspiracy after appearing before](https://en.wikipedia.org/wiki/Conspiracy_against_the_United_States)
[a federal judge in the U.S. state of Connecticut. He remains in detention.[25]](https://en.wikipedia.org/wiki/Connecticut) In September
2018, Levashov pleaded guilty.[27]


## See also

 References

1. ^ a b c _[Mills, Elinor (28 March 2012). "110,000 PC-strong Kelihos botnet sidelined".](http://news.cnet.com/8301-27080_3-57405527-245/110000-pc-strong-kelihos-botnet-sidelined/)_


_[CNET. Retrieved 28 April 2012.](https://en.wikipedia.org/wiki/CNET)_
2. ^ a b c d _Ortloff, Stefan (28 March 2012)._ _["FAQ: Disabling the new Hlux/Kelihos Botnet".](https://securelist.com/faq-disabling-the-new-hluxkelihos-botnet/32634/)_

_[Securelist.com. Retrieved 19 May 2020.](https://en.wikipedia.org/wiki/Securelist.com)_
3. ^ _Adair, Steven (30 December 2010). "New Fast Flux Botnet for the Holidays: Could it_

_be Storm Worm 3.0/Waledac 2.0?". Shadowserver. Retrieved 28 April 2012._
4. ^ _[Donohue, Brian (29 March 2012). "Kelihos Returns: Same Botnet or New Version?".](https://web.archive.org/web/20120404160139/http://threatpost.com/en_us/blogs/kelihos-returns-same-botnet-or-new-version-032912)_

_Threatpost. Archived from_ _[the original on 4 April 2012. Retrieved 28 April 2012.](http://threatpost.com/en_us/blogs/kelihos-returns-same-botnet-or-new-version-032912)_
5. ^ a b _Mills, Elinor (27 September 2011)._ _["Microsoft halts another botnet: Kelihos".](http://news.cnet.com/8301-1009_3-20112289-83/microsoft-halts-another-botnet-kelihos/)_ _[CNet.](https://en.wikipedia.org/wiki/CNet)_

_Retrieved 28 April 2012._


-----

6. _Kirk, Jeremy (1 February 2012). Kelihos botnet, once crippled, now gaining_


_strength"._ _[Network World. Archived from](https://en.wikipedia.org/wiki/Network_World)_ _[the original on 5 September 2012. Retrieved](http://www.networkworld.com/news/2012/020112-kelihos-botnet-once-crippled-now-255571.html)_
_28 April 2012._
7. ^ a b _Constantin, Lucian (28 March 2012). "Security Firms Disable the Second Kelihos_

_Botnet"._ _[PCWorld. Retrieved 28 April 2012.](https://en.wikipedia.org/wiki/PCWorld_(magazine))_
8. ^ a b _Boscovich, Richard (27 September 2011)._ _"Microsoft Neutralizes Kelihos Botnet,_

_Names Defendant in Case"._ _[Microsoft TechNet. Retrieved 28 April 2012.](https://en.wikipedia.org/wiki/Microsoft_TechNet)_
9. ^ _Microsoft (26 September 2011)._ _"Operation b79 (Kelihos) and Additional MSRT_

_September Release"._ _[Microsoft Technet. Retrieved 28 April 2012.](https://en.wikipedia.org/wiki/Microsoft_Technet)_
10. ^ _Latif, Lawrence (27 October 2011)._ _"Microsoft drops Kelihos botnet allegations_


_against ISP owner"._ _[The Inquirer. Archived from the original on 30 October 2011.](https://en.wikipedia.org/wiki/The_Inquirer)_
_[Retrieved 28 April 2012. {{cite web}} : CS1 maint: unfit URL (link)](https://en.wikipedia.org/wiki/Template:Cite_web)_
11. ^ a b _Gonsalves, Antone (24 January 2012). "Microsoft Says Ex-Antivirus Maker Ran_

_Botnet"._ _[CRN Magazine. Retrieved 28 April 2012.](https://en.wikipedia.org/wiki/CRN_Magazine)_
12. ^ _Warren, Tom (29 March 2012). "Second Kelihos botnet downed, 116,000 machines_

_freed"._ _[The Verge. Retrieved 28 April 2012.](https://en.wikipedia.org/wiki/The_Verge_(website))_
13. ^ _Brewster, Tom (24 January 2012). "Microsoft suspects ex-antivirus worker of Kelihos_

_botnet creation". IT PRO. Retrieved 28 April 2012._
14. ^ _Keizer, Gregg (24 January 2012). "Accused Kelihos botnet maker worked for two_

_security firms | ITworld"._ _[ITworld. Retrieved 28 April 2012.](https://en.wikipedia.org/wiki/ITworld)_
15. ^ _Donohue, Brian (28 March 2012). "Kaspersky Knocks Down Kelihos Botnet Again,_

_But Expects Return". ThreatPost. Archived from_ _[the original on 12 April 2012.](http://threatpost.com/en_us/blogs/kaspersky-sinkholes-kelihos-botnet-again-expects-resurrection-032812)_
_Retrieved 28 April 2012._
16. ^ a b _Raywood, Dan (2 April 2012). "CrowdStrike researchers deny that Kelihos has_

_spawned a new version – SC Magazine UK"._ _[SC Magazine. Retrieved 29 April 2012.](https://en.wikipedia.org/wiki/SC_Magazine)_
17. ^ _Leyden, John (29 March 2012). "Kelihos zombies erupt from mass graves after_

_botnet massacre"._ _[The Register. Retrieved 28 April 2012.](https://en.wikipedia.org/wiki/The_Register)_
18. ^ _SPAMfighter News (13 April 2012). "Kelihos Botnet Re-emerges, This Time Attacking_

_Social Networks". SPAMfighter. Retrieved 28 April 2012._
19. ^ [http://www.abuseat.org](http://www.abuseat.org/)
20. ^ _["Feds tracked down Russian spam kingpin with help from his iCloud account". The](https://www.theverge.com/2018/2/5/16975896/icloud-warrant-kelihos-botnet-levashov-affidavit)_

_Verge. Retrieved 6 February 2018._
21. ^ _Grizzard, Julian; David Dagon; Vikram Sharma; Chris Nunnery; Brent ByungHoon_

_[Kang (3 April 2007). "Peer-to-Peer Botnets: Overview and Case Study".](http://static.usenix.org/event/hotbots07/tech/full_papers/grizzard/grizzard_html/)_ _The Johns_
_Hopkins University Applied Physics Laboratory. Retrieved 28 April 2012._
22. ^ _SPAMfighter (5 April 2012). "Security Companies Take Down Kelihos Botnet of_

_Version 2". SPAMfighter. Retrieved 28 April 2012._
23. ^ _Jorgenson, Petra (6 April 2012). "Kelihos Botnet Could Resurge via Facebook_

_Worm". Midsize Insider. Retrieved 29 April 2012._
24. ^ _Arora, Arsh; Gannon, Max; Warner, Gary (15 May 2017)._ _"Kelihos Botnet: A Never-_


_Ending Saga". Annual ADFSL Conference on Digital Forensics, Security and Law._
25. ^ a b


-----

26. _[Alleged Operator of Kelihos Botnet Extradited From Spain . www.justice.gov. 2](https://www.justice.gov/opa/pr/alleged-operator-kelihos-botnet-extradited-spain)_

_February 2018. Retrieved 3 February 2018._
27. ^ _Farivar, Cyrus (13 September 2018). "Russian man pleads guilty, admits he ran_

_notorious Kelihos botnet"._ _[ArsTechnica. Retrieved 2 April 2019.](https://en.wikipedia.org/wiki/ArsTechnica)_

**[Botnets](https://en.wikipedia.org/wiki/Botnet)**

[Akbot](https://en.wikipedia.org/wiki/Akbot)
[Asprox](https://en.wikipedia.org/wiki/Asprox_botnet)
[Bagle](https://en.wikipedia.org/wiki/Bagle_(computer_worm))
[BASHLITE](https://en.wikipedia.org/wiki/BASHLITE)
[Bredolab](https://en.wikipedia.org/wiki/Bredolab_botnet)
[Cutwail](https://en.wikipedia.org/wiki/Cutwail_botnet)
[Conficker](https://en.wikipedia.org/wiki/Conficker)
[Donbot](https://en.wikipedia.org/wiki/Donbot_botnet)
[Festi](https://en.wikipedia.org/wiki/Festi_botnet)
[Grum](https://en.wikipedia.org/wiki/Grum_botnet)
[Gumblar](https://en.wikipedia.org/wiki/Gumblar)
Kelihos
[Koobface](https://en.wikipedia.org/wiki/Koobface)
[Kraken](https://en.wikipedia.org/wiki/Kraken_botnet)
[Lethic](https://en.wikipedia.org/wiki/Lethic_botnet)
[Mariposa](https://en.wikipedia.org/wiki/Mariposa_botnet)
[Mega-D](https://en.wikipedia.org/wiki/Mega-D_botnet)
[Mirai](https://en.wikipedia.org/wiki/Mirai_(malware))
[Metulji](https://en.wikipedia.org/wiki/Metulji_botnet)
[Nitol](https://en.wikipedia.org/wiki/Nitol_botnet)
[Rustock](https://en.wikipedia.org/wiki/Rustock_botnet)
[Sality](https://en.wikipedia.org/wiki/Sality)
[Slenfbot](https://en.wikipedia.org/wiki/Slenfbot)
[Srizbi](https://en.wikipedia.org/wiki/Srizbi_botnet)
[Storm](https://en.wikipedia.org/wiki/Storm_botnet)
[TDL-4](https://en.wikipedia.org/wiki/TDL-4)
[Torpig](https://en.wikipedia.org/wiki/Torpig)
[Virut](https://en.wikipedia.org/wiki/Virut)
[Vulcanbot](https://en.wikipedia.org/wiki/Vulcanbot)
[Waledac](https://en.wikipedia.org/wiki/Waledac_botnet)
[ZeroAccess](https://en.wikipedia.org/wiki/ZeroAccess_botnet)
[Zeus](https://en.wikipedia.org/wiki/Zeus_(malware))

**Notable botnets**


-----

[Browser security](https://en.wikipedia.org/wiki/Browser_security)
[Computer virus](https://en.wikipedia.org/wiki/Computer_virus)
[Computer worm](https://en.wikipedia.org/wiki/Computer_worm)
[Malbot](https://en.wikipedia.org/wiki/Internet_bot#Malicious_purposes)
[Internet security](https://en.wikipedia.org/wiki/Internet_security)
[Malware](https://en.wikipedia.org/wiki/Malware)
[Man-in-the-browser](https://en.wikipedia.org/wiki/Man-in-the-browser)
[Network security](https://en.wikipedia.org/wiki/Network_security)
[Operation: Bot Roast](https://en.wikipedia.org/wiki/Operation:_Bot_Roast)
[Trojan horse](https://en.wikipedia.org/wiki/Trojan_horse_(computing))

**Main articles**

Retrieved from "https://en.wikipedia.org/w/index.php?
title=Kelihos_botnet&oldid=1062846410"


-----