Google disrupts massive botnet used by hackers to mine crypto using Bitcoin blockchain

Google has disrupted Glupteba, a botnet that has spread malware to roughly a million Windows devices using the Bitcoin blockchain. The American multinational technology company stated that the perpetrators used the botnet to mine cryptocurrencies on victims’ computers.

Glupteba could resume operations shortly 

In a civil complaint filed on December 7 against two Russian nationals Dmitry Staroviko, Alexander Filippov, as well as 15 unknown individuals, Google revealed that Glupteba has infected more than one million machines worldwide. The botnet has been tracked by law enforcement and computer security experts for years.

Google alleged that the defendants used the botnet to steal victims’ account information to sell to third parties and mine cryptocurrencies on victims’ computers. The perpetrators used blockchain technology to protect themselves and bypass traditional tools that could disrupt malicious activities. According to Google executives, Bitcoin’s decentralization made it “much harder to shut down.”

The firm also reached out to internet infrastructure companies to take down services used by the hackers to control the network. Google’s services were used by the perpetrators to distribute the malware. As a result, the company took down approximately 63 million Google Docs, over 1,000 Google accounts and more than 900 Google Cloud projects that were used to spread Glupteba.

Google general counsel Halimah Delaine Prado and vice president of engineering Royal Hansen explained that the company does not only plug security holes, the firm is working to eliminate entire classes of threats for consumers and businesses that depend on the internet.

However, Google warned that Glupteba could continue to operate again due to the fact that the hackers have incorporated a fail-safe mechanism that uses the Bitcoin blockchain to issue commands. 

If the communication between the hackers and the botnet is cut off, the network will automatically search for messages posted by hackers for directions telling it how to reconnect through publicly accessible Bitcoin transactions.

According to blockchain analysis firm Chainalysis, this is the “first known case of a botnet using this approach.”