The group members are said to be "hiding in plain sight" in St. Petersburg, Russia. Koobface, which used Facebook and other malware tactics to gain "zombie" computers for a large botnet, has been around since 2008.
SophosLabs, the noted online security firm, says the identities of five of the Russian suspects have been handed over to law enforcement.
Through Facebook and email phishing with subject lines such as "You look just awesome in this new movie," the Koobface virus spread. Users who clicked through were met with an error message that their Flash player was out of date or their anti-virus software was no longer working. When they downloaded the new software, their computer became infected and PC joined the legion of zombie bots controlled by the Russian gang.
Last March, Facebook Security took down the Russian "Command and Control" server:
"This remained the case until last March, when Facebook Security was able to perform a technical takedown of this 'Command & Control' Mothership. Since then we have had no new sightings of Koobface for over nine months and our teams are working hard to keep it that way. While we have been able to keep Koobface off Facebook, we won't declare victory against the virus until its authors are brought to justice," added Facebook.
Written by: Andre Yoskowitz @ 17 Jan 2012 18:50
