# MA-470.042015: MyCERT Alert - Simda Botnet

**Date:** 20 Apr 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-470.042015  
**Advisory ID:** MA-470.042015

---

#### **1.0 Introduction** The Simda botnet is a network of computers infected with self-propagating malware that has compromised more than 770,000 computers worldwide. Since 2009, cyber criminals have been targeting computers with unpatched software and compromising them with Simda malware. This malware may re-route a user’s Internet traffic to websites under criminal control or can be used to install additional malware. The malicious actors control the network of compromised systems (botnet) through backdoors, giving them remote access to carry out additional attacks or to “sell” control of the botnet to other criminals. The backdoors also morph their presence every few hours, allowing low anti-virus detection rates and the means for stealthy operation.
**2.0 Impact**
A system infected with Simda may allow cyber criminals to harvest user credentials, including banking information; install additional malware; or cause other malicious attacks. The breadth of infected systems allows Simda operators flexibility to load custom features tailored to individual targets.
**3.0 Systems Affected**
Microsoft Windows
**4.0 Recommendations**
- *Use and maintain anti-virus software* - Anti-virus software recognizes and protects your computer against most known viruses. It is important to keep your anti-virus software up-to-date.
- *Change your passwords* - Your original passwords may have been compromised during the infection, so you should change them.
- *Keep your operating system and application software up-to-date* - Install software patches so that attackers cannot take advantage of known problems or vulnerabilities. Many operating systems offer automatic updates. If this option is available, you should enable it.
- *Use anti-malware tools* - Using a legitimate program that identifies and removes malware can help eliminate an infection. Users can consider employing a remediation tool (examples below) that will help with the removal of Simda from your system.
- Kaspersky Lab : <http://www.kaspersky.com/security-scan>
- Microsoft: <http://www.microsoft.com/security/scanner/en-us/default.aspx>
- Trend Micro: <http://housecall.trendmicro.com/>
- *Check to see if your system is infected* – The link below offers a simplified check for beginners and a manual check for experts.
- Cyber Defense Institute:  [http://www.cyberdefense.jp/simda/](http://www.cyberdefense.jp/simda)
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#32514b5057400b0b0b72514b50574041575147405b464b1c5f4b) or [[email protected]](/cdn-cgi/l/email-protection#325f4b51574046725f4b515740461c5d40551c5f4b) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- [US-CERT: Simda Botnet](https://www.us-cert.gov/ncas/alerts/TA15-105A)
- [Interpol Coordinates Global Operation to Take Down Simda](http://www.interpol.int/en/News-and-media/News/2015/N2015-038)
- [Microsoft partners with Interpol, industry to disrupt global malware attack](http://blogs.technet.com/b/mmpc/archive/2015/04/12/microsoft-partners-with-interpol-industry-to-disrupt-global-malware-attack-affecting-more-than-770-000-pcs-in-past-six-months-39-simda-at-39-designed-to-divert-internet-traffic-to-disseminate-other-types-of-malware.aspx)
- [Botnet that enslaved 770000 PCs worldwide comes crashing down](http://arstechnica.com/security/2015/04/botnet-that-enslaved-770000-pcs-worldwide-comes-crashing-down/)