The Glupteba botnet targets Windows computers to steal passwords or commit fraud through the infected computer and is thought to include about a million compromised devices. It is growing at a rate of thousands of new systems every day.

According to Google:

Glupteba is notorious for stealing users’ credentials and data, mining cryptocurrencies on infected hosts, and setting up proxies to funnel other people’s internet traffic through infected machines and routers.

The scale of the Glupteba operation is eye opening. In the last year, Google says they have identified and terminated 63 million Google Docs used to distribute the malware and 870 Google Ads accounts used as a malvertising platform to deliver the malware or commit payment fraud on Google Ads.  3 ½ million users were warned before downloading a malicious file through the Safe Browsing warnings supplied by Google.  In addition, Google has started legal proceedings against the individuals they believe are behind the botnet.

However, Google admits that one of Glupteba’s technical innovations will make it hard to completely shut down the botnet.

Usually a botnet searches out Command & Control (C2) servers which are hard coded into the client software or published on a domain or server controlled by the criminals.  This can leave the botnet vulnerable to law enforcement action as they can either seize the C2 servers or block access to them from the internet.

Glupteba’s innovation is the ability to publish the details of new C2 servers in a public and immutable location that cannot be blocked – that is the bitcoin blockchain itself.

The very first bitcoin transaction (held in the Genesis Block) included the short text message “The Times 03/Jan/2009 Chancellor on brink of second bailout for banks”.  As the blockchain grew the ability to store arbitrary text was moved to a scripting operator called OP_RETURN which allows 80 bytes of arbitrary data to be stored in an unspendable transaction that is permanently etched into the block chain.

Glupteba makes use of this feature by watching certain bitcoin wallet addresses and decoding the OP_RETURN code in order to receive the details of a new C2 server.