Skip to main content

Estonian Clickjacking Ring Totally Busted

An Eastern European clickjacking ring has been busted by American Law enforcement, stopping an organization that allegedly affected more than 4 million computers and scammed $14 million.

The scheme, concocted by Estonians Vladimir Tsastsin, Timur Gerassimenko, Dmitri Jegorow, Valeri Aleksejev, Konstantin Poltev and Anton Ivanov of and Russian Andrey Taame, involved the creation of a fake agency that contracting with online advertisers. They received a small fee every time an Internet user visited their website. In order to maximize their payoff, they distributed malware called DNSChanger which infected unwitting Internet users' computers and reconfigured DNS settings so that users would be redirected to the advertiser's sites if they clicked links generated by search engine results..

For instance, users who clicked a link to the Internal Revenue Service were redirected to H&R Block. Users who clicked links for iTunes were sent to www.idownload-store-music.com. Though the total of computers affected worldwide is near 4 million, around 500,000 American computers were affected. Individual Internet users were not themselves robbed by the ring - though if they purchased H&R Block's services, they were definitely robbed; Zing! - however, the malware does prevent infected computers from downloading security updates, leaving the vulnerable to other infections.  The FBI has posted a handout for people who suspect their computer may be infected.

  • nurgletheunclean
    I-tunes -> idownload-store-music, irs -> hr block. I seems very well engineered. I can't help suspect that those companies knew what they were paying them for.
    Reply
  • mouse24
    This can pretty much be done in the command line, honestly it was a semi inventive way to make a bit of cash, sure people were a bit annoyed at the so called malware but still, it didn't infect files nor did it take credit card information.

    Surely this must be a slap on the wrist type of offense

    Couldn't there prosecution have been prevented if they put up a small flier on there landing page saying "you agree that by visiting this site that the site owners cannot be held responsible for anything downloaded, etc etc etc." (bad wording, but im not a lawyer...)
    Reply
  • a sandwhich
    I am pretty sure I got this. Or something like it. Everytime I clicked a link it would redirect me somewhere. I just removed that old vista partition and got on with my life.
    Reply
  • ikyung
    I wonder why these con artists would clickjack iTunes Apple users? They are the smartest bunch of the IT flock. Obviously they would have erased the malware instantly! ......... Right?
    Reply
  • house70
    Another case of PEBKAC.
    Reply
  • alyoshka
    What is interesting is that there is no mention of the time frame when all this happened. They finally got busted, but when? they started off with this DNS Changer thingy from the Idiots book of blah blah blah but when? and how long did it take them make the 14Million greens? how long did it take them to infect the 4Million rigs and the 500,000 geeks?
    Reply
  • scrumworks
    Typical Estonian. Bunch of crooks whole nation.
    Reply
  • sa1nt
    scrumworksTypical Estonian. Bunch of crooks whole nation.All names and surnames are russian they just had estonian nationality.
    Reply
  • cookoy
    they should have patented the scheme, sold the info to the AV makers and live off the licensing fees they charge for each AV license sold.
    Reply
  • alyoshka - since 2006-2007
    Reply