Google Secures Court Order To Disrupt CryptBot Distribution

Google has obtained a temporary court order from a US District Court in a bid to disrupt the distribution of CryptBot, a Windows-based malware designed to steal sensitive information. The court order empowers the tech giant to disrupt the infrastructure and distribution network of CryptBot, which would help decrease the number of victims.

CryptBot specifically targets users of Google Chrome, and was estimated to have infected over 670,000 computers in 2022 alone. Once the malware infects a device, it silently harvests data, including login credentials, credit card information, and other personal or financial data, without the victims' knowledge. The data stolen can then be used for various criminal activities, including identity theft, financial fraud, and gaining unauthorized access to accounts and systems.

Google stated in a blog post on The Keyword, “Our litigation was filed against several of CryptBot’s major distributors who we believe are based in Pakistan and operate a worldwide criminal enterprise. The legal complaint is based on a variety of claims, including computer fraud and abuse and trademark infringement.” The company's CyberCrimes Investigations Group (CCIG) and Threat Analysis Group (TAG) teams worked to identify the distributors, investigate, and take action.

The court order will allow Google to take down domains associated with CryptBot distribution, both currently active and future domains. Google noted in the blog post that this will “slow new infections from occurring and decelerate the growth of CryptBot. Lawsuits have the effect of establishing both legal precedent and putting those profiting, and others who are in the same criminal ecosystem, under scrutiny.”

CryptBot has been traditionally delivered via maliciously modified versions of legitimate software packages, such as Google Earth Pro and Google Chrome, which are hosted on fake websites. More recently, CryptBot has also been found packaged with malicious installers for KMSPico, a tool that allows one to activate Microsoft Windows and Office software fraudulently without a license key.

To mitigate the risks posed by such threats, it is advised to only download software from well-known and trusted sources and ensure your antivirus and firewall systems are up to date.

Google's legal action to disrupt CryptBot follows its efforts to shut down the Glupteba botnet in December 2021. Despite resuming operations after the initial disruption action, Google's TAG observed a 78% drop in Glupteba infections.