Infamous Russian malware gang vanishes
A Russian gang allegedly hosting malicious software abruptly disappeared this week, according to Trend Micro. — The Russian Business Network, which allegedly was heavily involved in hosting packing kits—development suites for malicious software …
Context & Ripple Effects
The Russian Business Network did not disappear into a vacuum. Back in May 2007, CNET reported on a new gang war raging on the Internet, and through June Trend Micro was tracking waves of hacked Italian Web sites following the earlier LINKOPTIM malware pattern — a period in which criminal hosting operations were visibly competing and evolving.
This week, per Trend Micro, the network itself is gone. The firm alleges — though the claim remains unconfirmed — that RBN heavily hosted packing kits, the development suites used to build malicious software. If accurate, its abrupt exit pulls the rug out from under the customers renting that infrastructure.
First-order effects
- Malware operators who allegedly relied on RBN to host packing kits and malicious code lose their hosting platform overnight, forcing an immediate search for replacement infrastructure.
- Trend Micro gains a rare attribution win: naming the hub behind the 2007 attack campaigns it has been tracking since at least the June Italian-site infections.
Second-order effects
- Hosting demand displaces rather than dies — the customer base RBN served migrates to alternative bulletproof hosts, likely outside jurisdictions with active enforcement.
- Rival criminal networks from the spring's gang war can absorb displaced affiliates, consolidating the market around whichever operator offers reliable uptime.
Third-order effects
- If enforcement or infighting keeps dismantling fixed criminal hubs, malware operations trend toward portable, distributed hosting models that are harder for vendors like Trend Micro to pin down by network address alone.
The trend: Criminal web infrastructure is professionalizing into commercial hosting services whose disruption pushes malware operations toward ever more mobile and resilient setups.