Anatomy of a Breach

Anatomy of a Breach: The Mariposa Botnet — 12.7 Million Zombies and Three Script Kiddies

> series: anatomy_of_a_breach —— part: 014 —— target: 12,700,000_computers —— countries: 190 —— operators: 3_amateurs<span class="cursor-blink">_</span>_

Hedgehog Security 28 February 2010 13 min read

12.7 million computers. Three operators. No advanced skills.

In February 2010, Spain's Guardia Civil arrested three men in connection with the Mariposa botnet — a network of 12.7 million infected computers that spanned 190 countries and had compromised over half of the Fortune 1,000 companies and at least 40 major banks. The botnet's name, Spanish for 'butterfly', belied its destructive capability: Mariposa was used to steal banking credentials, launch denial-of-service attacks, and install additional malware including the Zeus banking trojan on victim machines.

But the most striking aspect of the Mariposa case was not the scale — it was the operators. Captain Cesar Lorenzana of the Guardia Civil described them as 'normal people who are earning a lot of money with cybercrime.' They had not written the malware themselves — they had purchased it from a Slovenian developer known as 'Iserdo' for as little as $500. Security researcher Brian Krebs noted that the operators did not have advanced hacking skills. They were, in modern parlance, script kiddies — and they controlled one of the largest botnets in history.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

How an international coalition killed the Butterfly.

The Mariposa Working Group — a coalition of Panda Security, Canadian firm Defence Intelligence, the Georgia Tech Information Security Center, the FBI, and Spain's Guardia Civil — spent months infiltrating the botnet's command-and-control infrastructure. On 23 December 2009, the group seized control of the C2 servers and disabled the botnet.

The botnet operators fought back. The ringleader, known as 'Netkairo', bribed an employee at a Spanish domain registrar to regain control of the domains, then launched a denial-of-service attack against Defence Intelligence at 900 megabits per second — an attack so powerful it knocked out internet connectivity for an ISP's entire customer base, including several Canadian universities and government agencies. The Working Group regained control, and Netkairo made his fatal error: connecting directly from his home computer without using a VPN, exposing his real IP address.


What 12.7 million zombies can do.

Fortune 1000 and Banking Infiltration
Over half the Fortune 1,000 and at least 40 major banks had Mariposa-infected machines inside their networks. The botnet stole banking credentials, captured keystrokes, and provided a persistent backdoor into corporate infrastructure. A US utility company discovered its infection only when a partner organisation noticed an employee visiting with an infected laptop.
Malware-as-a-Service
Mariposa was built using the 'Butterfly Bot' toolkit, created by a 23-year-old Slovenian developer and sold commercially to anyone willing to pay $500–$1,300. The operators did not need to understand malware development — they bought a product, deployed it, and operated it like a business. This was cybercrime-as-a-service before the term existed.
Multiple Infection Vectors
Mariposa spread through P2P networks, infected USB drives, and MSN messaging links. The USB vector was particularly effective in corporate environments — <a href="https://www.cisa.gov/news-events/ics-advisories/icsa-10-090-01">CISA documented</a> a case where a USB drive shared at an industry conference infected a utility company's corporate network. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> includes USB drop and social engineering assessments for exactly this reason.
Legal Inadequacy
Under Spanish law at the time, owning and operating a botnet was not specifically illegal. Prosecutors had to prove the operators used the botnet for identity theft or fraud to secure convictions. The case exposed a gap between cybercrime capability and legal frameworks — a gap that many jurisdictions have since closed.

Detecting botnet infections in your network.

Mariposa demonstrated that botnet infections can persist inside corporate networks — including Fortune 1,000 companies — without detection by anti-virus, IDS, or firewalls. The malware evolved every 48 hours, outpacing signature-based detection. This is exactly why SOC in a Box uses behavioural detection alongside signature matching — identifying the anomalous command-and-control communications, unusual network traffic patterns, and credential theft indicators that botnet infections produce.

Our infrastructure penetration testing assesses whether your network's defences would detect and block botnet-style command-and-control traffic. Our vulnerability scanning identifies the unpatched systems and insecure configurations that botnets exploit for initial infection. And Cyber Essentials certification establishes the baseline controls — patching, access control, malware protection — that reduce botnet infection risk. For threat intelligence on active botnets targeting your sector, UK Cyber Defence provides the intelligence feeds that inform proactive defence.


Could your network be part of a botnet right now?

If Fortune 1,000 companies and major banks had Mariposa infections without knowing it, the question for every organisation is not whether you could be infected — but whether you would know if you were. <a href="https://www.socinabox.co.uk">SOC in a Box</a> provides the continuous monitoring that detects botnet C2 communications. <a href="/penetration-testing/infrastructure">Penetration testing</a> validates your detection capabilities.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles