Companies like Google play a critical role in keeping software users safe in the ever-evolving world of modern cybersecurity. While oftentimes that takes a technical approach, plugging vulnerabilities prone to exploitation, it can also involve legal efforts to drag bad actors to justice. Right now, we’re looking at a mix of both of those, as Google moves against the distributors of the CryptBot malware, with a little help from the courts.
It’s easy enough to miss fresh additions to the ever-growing sea of suspicious software, but the CryptBot malware is one of the worst kinds. Disguised as conventional software, like a web browser or application, it steals the victim’s personal information including login credentials, authentication codes, and crypto wallet data.
Through data brokers, these crooks sell this stolen data to other malware makers and distributors, who use it to launch more targeted and dangerous attacks. Google has already observed CryptBot being disguised as Google Earth Pro and the popular Chrome browser. The company estimates it infected 670,000 in the past year alone.
With its brand identity at stake, Google’s Threat Analysis Group (TAG) got involved and determined that CryptBot is mostly distributed by Pakistan-based entities, who are a part of a larger, nefarious global enterprise. The company sought civil action against these distributors in front of a US federal judge, alleging computer fraud, abuse, and trademark infringement. The court ultimately granted a temporary restraining order to help Google disrupt CryptBot’s distribution.
Specifically, Google was looking to upset CryptBot’s command and control infrastructure by seizing the domain names being used to coordinate these malware efforts.
Ridding the online world of criminals is the moral duty of every internet user, but Big Tech companies are in a position of power, enabled by their resources to bring the ill-intentioned to justice. Google is doing the right thing here, but it can be notoriously difficult to coordinate law-enforcement efforts across international boundaries.
Google’s courtroom success doesn’t negate the importance of safe web surfing practices. We strongly urge you to download apps and software only from credible, official sources. Keep your operating systems up to date and pay close attention to links in emails and the URLs of websites you visit, because spoofing official-looking webpages is remarkably easy.
Hopefully this is the last we hear of the CryptBot malware and its distributors.
