Malicious applications for Android created their network and dealt massive strikes on popular sites in Russia and Asia.
The team of specialists was able to neutralize the botnet - an army of infected mobile phones running Android from Google, - reports Fortune.
These phones have launched hundreds of malicious applications that this summer leaked into the Google Play app store. Many of them masqueraded as media and video players, ring tones or tools for storage and application store managers, and were mainly downloaded to the markets of Russia, China and other Asian countries.
It all started with the fact that malicious programs performed pop-up ads and their creators earned money on clicks from users.
This fraudulent scheme, in fact, is not new. Users, including in Ukraine, repeatedly installed innocuous programs, and the load received a bunch of pop-up ads.
However, over time, this botnet, which experts dubbed WireX, created a kind of artillery system for DDoS attacks - simultaneous attacks from multiple devices to a specific site in order to bring it to an end.
Google identified and blocked 300 applications that caused this problem.
A total of 120,000 gadgets were infected. The peak of attacks occurred in early August, when the botnet sent 20,000 page requests per second to the target site page. Now the botnet is still active, but its activity has declined.
To fight the botnet, experts were deployed in the field of content delivery networks Akamai and Cloudflare, a company exploring cyberthreats Flashpoint, developers of Internet infrastructure from Oracle, cyber security experts from RiskIQ and Team Cymru, as well as the FBI.
"This is the first time when we saw a very large network of Android mobile phones used to launch DDoS attacks," said Matthew Prince, CEO and co-founder of Cloudflare.
However, this is not the most powerful botnet of the existing. The championship belongs to Mirai, which caused disruptions in the Internet on the east coast of the United States. He sent hundreds of millions of requests per second.
However, this time the danger is that the applications acted in secret - they attacked the sites even when mobile devices were "sleeping".