Cyber Crime and Cyber Terrorism

FIGURE 17.10
ZeroAccess variants roadmap.

---

249
 
Countermeasures for fighting botnets or mitigating botnets effects 
them employing their own methods of distributing the Zeroaccess installers, in order 
to fulfill the recruiter’s requirements.
The most popular distribution methods seen involve exploit kits, spam e-mails, 
trojans-downloaders, and fake media files available on P2P file-sharing services and 
video sites, although the specific details depend on the distributor handling the op-
erations. The variety of distribution schemes, and methods used by the numerous 
affiliates have contributed to the volume of “Trojan dropper” variants detected by 
antivirus products every day.
They are all driven by the same motive which is to collect attractive revenue 
share from the gang. The partners are compensated based on a Pay-Per-Install (PPI) 
service scheme and the rate differs depending on the geographical location of the 
machine on which the malware was successfully installed. A successful installation 
in the United States will net the highest payout, with the gang willing to pay USD 
500 per 1000 installations in that location.
Given the rate of pay, it is no surprise that ZeroAccess is widespread in the US 
alone. After the US, the commission rate sorted from highest to lowest are Australia, 
Canada, Great Britain, and others. Some distributors even post screenshots of the 
payment they have received in underground forums to show the reliability of their 
recruiter. The ZeroAccess team can afford to pay such high incentives to its recruits 
because the army of bots created by the affiliate’s efforts is able to generate even 
more revenue in return. Once the malware is successfully installed on the victim ma-
chines, ZeroAccess will begin downloading and installing additional malware onto 
the machines, which will generate profit for the botnet operators through click fraud 
operations.
The affiliate program, as an interesting criminal business model, encourages the 
spread of malware and attracts more cybercriminals due to the botnet operators’ es-
tablished reputation for reliably paying its affiliates and adjusting commission rates 
to maintain their attractiveness. The criminal organizations behind the botnet have 
shown that they are willing to experiment and modify their “product” in order to 
increase their ability to make money.
The Europol’s European Cybercrime Centre (EC3), supported by Microsoft 
Corporation’s Digital Crimes Unit and other industry partners, announced that has 
successfully disrupted ZeroAccess network in 2013, but, as we know, P2P networks 
are very resilient to disruption and some backfire are expected (EC3, 2013).