A financial twist to the Zotob case

Some more information on the story around the arrest of two suspects in the Zotob, and Mytob, cases. A story in the Washington Post on Friday reports that there is a financial information theft aspect to the Zotob worm, as well as the Mytob worm. This perspective is also being reported in Maghreb Arabe Presse in Morocco.

Louis M. Reigel III, director of the FBI's Cyber Division, said evidence indicates Ekici paid Essebar to develop the worms, which the two used for financial gain. Reigel declined to say whether the men were connected to a larger criminal enterprise. But according to information released by the Moroccan government, the two men are alleged to have forwarded financial information stolen from victims' computers to a credit card fraud ring.

And finally, eWeek has an interesting summary of the Zotob timeline from the Microsoft perspective. Source: Suspected Zotob Worm Authors Arrested, by Brian Krebs, posted on Washingtonpost.com on Friday, August 26, 2005.

So how did they break this case so quickly? According to the F-Secure antivirus weblog, the handles used by the men, "diabl0" and "coder", are appearant in the worm. This has shades of the Blaster.C variant and the "teekids" handle.

Both nicknames can be found from the code of Zotob.A: the worm connected to a irc server named "diabl0.turkcoders.net" and contained the words "Greetz to good friend Coder".

Source: Breaking news: two arrests in the Zotob case, Friday, August 25, 2005.