The Chinese firm that operated a web-hosting company, 3322.org, which was associated with the Nitol DDoS botnet has agreed to work with Microsoft to prevent cybercriminals from using the domain.
Under the legal settlement to resume control of 3322.org, its founder Peng Yong has assured that he would work in collaboration with Microsoft and China’s central computer security agency to restrict misuse of the site’s domains.
In September, Microsoft had filed a suit to operate the 70,000 malicious subdomains that were hosted on 3322.org, and investigate a cybercrime gang.
Microsoft’s Operation b70 investigation revealed that several PCs were found to be preloaded with malicious code during their production at facilities, which was managed by infiltrating anxious supply chains to install the code.
But, further investigation revealed that the malware was most probably installed by a distributor, transporter, or reseller.
MIcrofost Digital Crimes Unit said in a statement to CBR in this particular case, Microsoft discovered that retailers were selling computers loaded with counterfeit versions of Windows software embedded with harmful malware.
"This means that the malware is loaded after the product is shipped by the original equipment manufacturer to a distributor, transporter, or reseller," the statement added.
According to the investigation, the Nitol developers had hired webspace from 3322.org and used it as a command and control system for their rising collection of infected computers.
