ICTA says malicious server not in Cayman Islands

(CNS): UPDATE – UK researchers who reported that a malicious server in the Cayman Islands had been the source of the trojan Zbot have conceded that the server is not in these islands at all but is, in fact, in Britain. David Archbold, Managing Director of the Information & Communications Technology Authority (ICTA), said that he investigated the article published in SC Magazine and linked on CNS this morning, based on the findings of researchers from Prevx, who had discovered the site where the criminal operation had used the Trojan horse to upload the FTP login credentials from more than 68,000 websites, including companies such as Bank of America, BBC, and Symantec.

Prevx, a company that sells software to find and destroy malware, said the server was in the Cayman Islands. However, Archbold investigated the claims and found otherwise.

“I conducted my own research, and talked with the UK Researcher who made the original comments. I am now satisfied that the server in question is not, and never has been, located in the Cayman Islands but rather is in northern England," Archbold said. "The only Cayman Islands connection is that the criminals involved used a false George Town address when registering a range of network IP addresses. Subject to some final checks, the UK Researcher has accepted my findings.”

A CNS reader tracked down the IP address, which also listed the phone number of one of the churches on Grand Cayman, and found, through the Google search engine, a screenshot of the site which has now been shut down: linked here.

Go to article in SC Magazine