Estonian Clickjacking Ring Totally Busted

An Eastern European clickjacking ring has been busted by American Law enforcement, stopping an organization that allegedly affected more than 4 million computers and scammed $14 million.

The scheme, concocted by Estonians Vladimir Tsastsin, Timur Gerassimenko, Dmitri Jegorow, Valeri Aleksejev, Konstantin Poltev and Anton Ivanov of and Russian Andrey Taame, involved the creation of a fake agency that contracting with online advertisers. They received a small fee every time an Internet user visited their website. In order to maximize their payoff, they distributed malware called DNSChanger which infected unwitting Internet users' computers and reconfigured DNS settings so that users would be redirected to the advertiser's sites if they clicked links generated by search engine results..

For instance, users who clicked a link to the Internal Revenue Service were redirected to H&R Block. Users who clicked links for iTunes were sent to Though the total of computers affected worldwide is near 4 million, around 500,000 American computers were affected. Individual Internet users were not themselves robbed by the ring - though if they purchased H&R Block's services, they were definitely robbed; Zing! - however, the malware does prevent infected computers from downloading security updates, leaving the vulnerable to other infections.  The FBI has posted a handout for people who suspect their computer may be infected.

Create a new thread in the US News comments forum about this subject
This thread is closed for comments
Comment from the forums
    Your comment
    Top Comments
  • ikyung
    I wonder why these con artists would clickjack iTunes Apple users? They are the smartest bunch of the IT flock. Obviously they would have erased the malware instantly! ......... Right?
  • Other Comments
  • nurgletheunclean
    I-tunes -> idownload-store-music, irs -> hr block. I seems very well engineered. I can't help suspect that those companies knew what they were paying them for.
  • mouse24
    This can pretty much be done in the command line, honestly it was a semi inventive way to make a bit of cash, sure people were a bit annoyed at the so called malware but still, it didn't infect files nor did it take credit card information.

    Surely this must be a slap on the wrist type of offense

    Couldn't there prosecution have been prevented if they put up a small flier on there landing page saying "you agree that by visiting this site that the site owners cannot be held responsible for anything downloaded, etc etc etc." (bad wording, but im not a lawyer...)
  • a sandwhich
    I am pretty sure I got this. Or something like it. Everytime I clicked a link it would redirect me somewhere. I just removed that old vista partition and got on with my life.