The FBI said that six people have been arrested in connection with a
click-fraud scheme that infected more than four million computers in
countries around the world. The arrests were the result of a two-year
investigation known as Operation Ghost Click. All six were arrested in
Estonia. A seventh defendant, who is Russian, is still at large. The US
attorney’s office will seek extradition of those in custody. The malware
used in the scheme is known as DNS Changer. DNSChanger virus changed the
DNS settings on the infected computers pointing them to DNS servers
under the control of the criminals. They could then redirect victim’s
traffic from legitimate sites, e.g. iTunes, to other sites where they
earned more than $14 million from commissions on referrals to the online
advertising. The defendants are facing charges of wire and computer
intrusion. One was also charged with money laundering. The FBI worked
with law enforcement authorities in Estonia and the Netherlands on the
case. The attack targeted both Windows and Mac OS X machines.
