Conficker: The worm that nearly ate the internet

Combing through the relatively few experts who used the websites just before Conficker C appeared, investigators found the IP address of smartsystem.com.ua — the address of a Ukrainian company that was the recipient of millions swindled by TrafficConverter.biz . Computers at their residences revealed direct links to smartsystem.com.ua, to TrafficConverter.biz and to the coding work and planning behind Conficker. Because fewer victims know how to use such payment methods, the criminals try to make up the gap by raising the ransom fees tenfold from the old credit card days.

Source: www.nytimes.com