Simda Botnet

The Simda Botnet is a Trojan network of compromised Windows systems. Although its C&C server infrastructure is defunct currently, Trojan 'bots' still can be threatening and cause various security issues, such as opening a backdoor for attackers or installing other threats. Users should protect themselves from these attacks by having compatible security solutions for removing Simda Botnet Trojans on sight.

From a Criminal's Kit to Your PC with a Basket of Browser Hijackings

A multi-nation, joint cyber-security operation in 2015 is responsible for the 'death' of the Simda Botnet. Still, individual Trojans and related threats can prove themselves deadly to any Windows user who values their privacy. This black hat business is primarily a third-party threat deliverer, similar to the Buer Trojan downloader. In another aspect of similarity, its programmers have their eye on the security industry, and how they might adjust their 'product' for evading it.

The Simda Botnet design emphasizes 'temporary' infections leading to long-term ones. The Trojan deactivates itself (after a command from the, notably no-longer-running Command & Control servers) optionally, and replaces the user's Hosts file with an internally-embedded one. The Hosts file is long-known as a point of abuse for browser hijackers and even some file-locker Trojans, who use it, like the Simda Botnet, for changing how victims' PCs interact with the IP addresses that map to websites.

Through the latter feature, the Simda Botnet may block websites or redirect users to unwanted ones. Google Analytics and Facebook domains are examples of some of the targets, forcing traffic towards third-party domains. These domains load drive-by-download exploits for installing other threats, with the Simda Botnet's original admins previously reaping financial benefits from the pay-per-installation scheme.

Preventing the Little Browser Exploits Leading to Larger Issues

The Simda Botnet is one of many beneficiaries of Exploit Kits for the installation of its Trojans. These bundles of vulnerability-abusing packages, such as the Blackhole Exploit Kit and the RIG Exploit Kit, trigger threat-installing attacks by using security loopholes, in scripts particularly. Users have better chances of evading these attacks by updating their software and turning off some features on untrustworthy websites, including Flash, Java and JavaScript.

Thematically, users should be cautious of unsolicited updates or update prompts that don't come from official company websites. Flash updates are a typical means of drive-by-download attacks that can install other threats, including file-locker Trojans, spyware, or rootkits. Malware analysts also recommend checking the Hosts file periodically – a text configuration file in Windows installations – for unwanted changes.

If necessary, users can download free replacements for their Host files or repair Windows from an appropriate source. Since this threat is years old, professional anti-malware products should be more than capable of removing the Simda Botnet's Trojan clients.

The Simda Botnet works hand-in-hand with other criminals for achieving its goals, but that cooperation didn't prevent the sinkhole op that destroyed its C&C contacts. It might be a cripple without them, but even a hobbled Trojan can be unsafe on a typical computer.