29A virus-writing gang shuts down

A notorious virus-writing gang has announced that it has ceased its operations.

In a posting on 29A’s website, group member VirusBuster announced the end of a gang that was responsible for writing malware such as Cabir (which infected Symbian mobile phones), Duts (the first ever Pocket PC virus, bizarrely inspired by a science fiction novel), Haiku (which generated Japanese-style poetry), Stream (which was the first virus to take advantage of NTFS Alternate Data Streams), Lindose (which infected both Windows and Linux computers), and Donut (a .NET aware Windows file infector).

29a-close

This isn’t the first time that 29A members have made the news of course.  For instance, in November 2004 a Russian court fined 29A gang member Eugene Suchkov after he admitted writing the Stepan and Gastropod viruses.  In the same month, Czech 29A virus writer Marek Strihavka (aka “Benny”) was interviewed by police and had his computers confiscated.

Sign up to our free newsletter.
Security news, advice, and tips.

The fact is that 29A had not been actively writing malware for some time, and there are few who are surprised in the security industry to see them hanging up their jackets.  More and more malicious code today is written by organized criminal gangs with financial motivations, rather than amateur Vx groups like 29A. 

Perhaps 29A finally realised that in the current climate, with more and more cybercriminals being sent to jail for serious amounts of time, being associated with virus-writing was not a good idea.

PS. For those who are curious, 29A got their name from the hexadecimal for the number 666.  Charming.


Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.