Google Wins Legal Battle Against Glupteba Botnet

Google has announced a legal victory against two Russian nationals connected with the Glupteba botnet.

In a blog post last Friday, the tech giant said the court’s ruling against the botnet operators set a crucial legal precedent and sends a warning to cyber-criminals and their accomplices.

“Last December, Google’s Threat Analysis Group (TAG) shared the actions it took to disrupt the operations of the Glupteba botnet,” wrote Google’s vice president of engineering for privacy, safety and security Royal Hansen and the company’s general counsel Halimah DeLaine Prado.

“Our legal team also filed a case in the Southern District of New York to hold the botnet operators accountable. We made the explicit decision to name the criminal actors behind Glupteba as defendants in the suit, to expose them and their various shell companies.”

Hansen and DeLaine Prado said the legal tactic was not a common one. Still, the Google legal team felt it was important to try and disrupt the botnet group’s ability to operate covertly online.

“We did this knowing it could lead to drawn-out litigation. The risk was that these actors – who are based in Russia – could attempt to abuse the US court system by litigating from abroad with no intention of complying with the court’s orders and could try to use the legal process to get information about Google’s defense mechanisms. They attempted to do exactly that.”

However, the company said that the court saw through these attempts and granted Google’s motion for sanctions, entering a default judgment against the defendants in order to hold them responsible for trying to mislead the court.

“In an extraordinary move, the court also issued monetary sanctions against both the Russian-based defendants and their US-based lawyer – requiring the criminal actors behind Glupteba to pay Google’s legal fees,” the blog post reads.

“This step is particularly important because it shows that there will be real, monetary consequences for engaging in this type of criminal activity.”

While Glupteba operators have reportedly resumed activity on some platforms and IoT devices, the company believes that sharing the group’s legal defeat makes it less appealing for other criminal groups to collaborate with them.

“And the steps TAG took last year to disrupt their operations have already had a significant impact. Over the past year, TAG has observed a 78% reduction in the number of infected hosts.”

The ruling comes weeks after Google unveiled a new open-source project named Graph for Understanding Artifact Composition (GUAC) to improve software supply chain security.