International Cyber Ring That Infected Millions of Computers Dismantled

Six Estonian nationals have been arrested and charged with running a sophisticated Internet fraud ring that infected millions of computers worldwide with a virus and enabled the thieves to manipulate the multi-billion-dollar Internet advertising industry. Users of infected machines were unaware that their computers had been compromised—or that the malicious software rendered their machines vulnerable to a host of other viruses.

Details of the two-year FBI investigation called Operation Ghost Click were announced today in New York when a federal indictment was unsealed. Officials also described their efforts to make sure infected users’ Internet access would not be disrupted as a result of the operation.

The indictment, said Janice Fedarcyk, assistant director in charge of our New York office, “describes an intricate international conspiracy conceived and carried out by sophisticated criminals.” She added, “The harm inflicted by the defendants was not merely a matter of reaping illegitimate income.”

Beginning in 2007, the cyber ring used a class of malware called DNSChanger to infect approximately 4 million computers in more than 100 countries. There were about 500,000 infections in the U.S., including computers belonging to individuals, businesses, and government agencies such as NASA. The thieves were able to manipulate Internet advertising to generate at least $14 million in illicit fees. In some cases, the malware had the additional effect of preventing users’ anti-virus software and operating systems from updating, thereby exposing infected machines to even more malicious software.

“They were organized and operating as a traditional business but profiting illegally as the result of the malware,” said one of our cyber agents who worked the case. “There was a level of complexity here that we haven’t seen before.”

DNS—Domain Name System—is a critical Internet service that converts user-friendly domain names, such as www.fbi.gov, into numerical addresses that allow computers to talk to each other. Without DNS and the DNS servers operated by Internet service providers, computer users would not be able to browse websites or send e-mail.

DNSChanger was used to redirect unsuspecting users to rogue servers controlled by the cyber thieves, allowing them to manipulate users’ web activity. When users of infected computers clicked on the link for the official website of iTunes, for example, they were instead taken to a website for a business unaffiliated with Apple Inc. that purported to sell Apple software. Not only did the cyber thieves make money from these schemes, they deprived legitimate website operators and advertisers of substantial revenue.

The six cyber criminals were taken into custody yesterday in Estonia by local authorities, and the U.S. will seek to extradite them. In conjunction with the arrests, U.S. authorities seized computers and rogue DNS servers at various locations. As part of a federal court order, the rogue DNS servers have been replaced with legitimate servers in the hopes that users who were infected will not have their Internet access disrupted.

It is important to note that the replacement servers will not remove the DNSChanger malware—or other viruses it may have facilitated—from infected computers. Users who believe their computers may be infected should contact a computer professional. They can also find additional information in the links on this page, including how to register as a victim of the DNSChanger malware

Berlusconi promises to resign amid Italy debt woes

Italian Premier Minister Silvio Berlusconi said for the first time Tuesday that he would resign once parliament approves economic reforms, and Greek politicians said they were close to agreeing on a new government to lead their country through painful cutbacks.

Both governments are under heavy pressure to reassure financial markets that the 17-country eurozone is moving quickly to reduce crippling government debts before those debts break apart the monetary union and plunge the world into a new recession.

Berlusconi's promise to resign came during a meeting with Italian President Giorgio Napolitano after the premier lost his parliamentary majority during a routine vote earlier Tuesday. In a statement, Napolitano's office said Berlusconi had agreed to step down once the economic reforms have passed parliament. A vote on the measures is planned for next week.

Wealthier European countries including Germany and France have already bailed out struggling Greece, Ireland and Portugal, and Greece will get another €100 billion ($138 billion) of debt relief as soon as it resolves its political crisis.

Senior government officials said Greece would get a new prime minister later Tuesday. They spoke on condition of anonymity because of the secrecy surrounding the second day of talks between Prime Minister George Papandreou and opposition leader Antonis Samaras. They hope to reach a power-sharing deal that will prevent Greece from going bankrupt.

Italy poses an even graver challenge: Europe can't afford to bail out its €1.9 trillion ($2.6 trillion) debt pile, and wants to see Italy live up to promises to rein in spending and improve lagging growth so it can pay it off itself. Few believe Berlusconi — sapped by scandal and economic bungling — has the political clout to get that done, and calls had increased for him to resign.

Among those urging that he step down was Berlusconi's main coalition ally, Northern League leader Umberto Bossi, who told reporters Tuesday: "We asked him to step aside, take a step to the side." Bossi is the volatile ally who brought down Berlusconi's first conservative government in 1994.

His comments came as he arrived for a much-watched vote that Berlusconi survived, but which laid bare the prime minister's lack of support in Parliament.

The vote, on a routine budget measure, won 308 votes of approval and no votes against in the lower house. But 321 deputies abstained from voting, most of them from the center-left opposition. If all 630 lawmakers had voted, Berlusconi would need a 316-seat majority to assure he was still in command.

Berlusconi scrutinized the vote tally handed him right after the vote, apparently trying to figure out who had abstained.

"This government does not have the majority!" thundered opposition leader Pierluigi Bersani, rising up in the chamber. "We all know that Italy is running the real risk in the next days to not have access to financial markets."

He was referring to Italy's borrowing rates, which have been soaring amid weeks of political uncertainty over Berlusconi's ability to oversee the adoption of austerity measures to fight Italy's growing debt burden.

Italian bond yields — the interest rates Italy would need to pay when it borrows money — reached their highest point since the country joined the euro in 1999 on increasing fears of default. The yields hit 6.73 percent, not far from the 7 percent levels that pushed Ireland, Portugal and Greece to seek bailouts.

Higher yields are signs of market fear of default and reluctance to lend, and they also make debt harder to repay in a vicious circle, since Italy needs to take out new loans to pay off the old ones.

The European Central Bank has been buying government bonds as a last-ditch defense to drive down yields and borrowing costs, but the bank insists the program is temporary. Eurozone finance ministers are working on ways to strengthen their €440 billion bailout fund and give it effective lending power of over €1 trillion through financial leverage and attracting money from private investors.

Even that wouldn't be enough to save Italy, the eurozone's third-largest economy.

In Greece, Papandreou and Samaras agreed over the weekend to forge an interim government that will shepherd the country's new €130 billion ($179 billion) European rescue package through Parliament.

By Tuesday afternoon there were still no details of when an interim prime minister would be announced, but the pressure was increasing on Greek politicians to make decisions soon. There was mounting speculation that a former deputy at the European Central Bank, Lucas Papademos, might replace Papandreou.

The country's ministers offered their resignations to Papandreou on Tuesday to pave the way for the creation of the interim government, which is only expected to last until Feb. 19 when a newly elected government would take over.

"We have made our resignation available to the prime minister in order to help him with his actions," Tourism Minister George Nikitiadis said. "My feeling is that tonight we will have a name (of the new premier). It's going well."

Greece's eurozone partners are demanding that Papandreou, Samaras and three other Greek officials co-sign a letter reaffirming their commitment to the country's bailout deals and economic reforms, in return for the release of a vital €8 billion ($11 billion) loan installment later this month, according to a senior government official who spoke on condition of anonymity because the demand was not public.

In return for its bailout cash, Greece has endured 20 months of punishing austerity measures. The efforts by Papandreou's government to keep the country solvent have prompted violent protests, crippling strikes and a sharp decline in living standards for most Greeks