ESET spots Georgia linked botnet site

But does that mean Georgia is conducting the cyber-espionage, or that its website run by the Georgia government is compromised by enemies of the country? Because the botnet's command-and-control operations lack some elements of stealth that might be expected, the Slovakian security firm that spotted it -- ESET -- reports it may simply be "a group of cyber criminals trying to find sensitive information in order to sell it to other organizations."

Win32/Georbot has a command-and-control structure that has exploited the website of the Georgian government for some time to drive some controls, says ESET researcher Righard Zwienenberg. When ESET detected evidence of Georbot as malware in January, it contacted the Georgian CERT. As it turns out, the Data Exchange Agency of the Ministry of Justice of Georgia and its national CERT were fully aware of the situation as early as 2011 and have been monitoring Georbot, now in cooperation with ESET.

Georbot is primarily a cyber-espionage botnet that has infected only about 200 computers that appear to be mainly in the country of Georgia, though about 30% of them are in the U.S., Germany and Russia. It's not clear who these individuals are, Zwienenberg says, but Georbot is "looking on their hard drives for documents," and can also capture audio and video when the computer's webcam and microphone are in use.

Georbot is also remotely controlled to steal documents and certificates, and look for certain words in documents, among them "ministry," "service," "secret," "top," "agent," "army," "USA," "Russia," "Georgia," "major," "Colonel," "FBI," "CIA," "phone number," "east," "program," "KGB," "FSB" and other political and personal information.

Based on ESET's analysis, Georbot does have features to hide itself. But it's not especially sophisticated since it has left some information unencrypted, lending doubt to whether a capable government spy operation from any country would be operating this. ESET got a look at the control panel for it to analyze what it was doing.