Cloud

1/10/2018
05:03 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

AWS, Google Cloud Popular Home for Botnet Controllers

The number of command-and-control listings increase 32% in 2017, with more botnet controllers hosted in the cloud.

Botnet controllers increased by 32% in 2017, and more cybercriminals are taking advantage of legitimate cloud providers like Amazon and Google to host them, researchers report.

The team at Spamhaus Malware Labs this week published its 2017 Botnet Threat Report, which digs into the numbers and trends behind botnet threats encountered throughout the year. In 2017, the company identified and issued Spamhaus Block List (SBL) listings for more than 9,500 botnet command-and-control (C&C) servers on 1,122 different networks. SBL refers to a database of IP addresses from which the organization doesn't recommend accepting mail.

As a means to control malware-infected machines and exfiltrate data, C&C servers play a critical role in operations to distribute spam, ransomware, and banking Trojans, launch DDoS attacks, and mine cryptocurrencies like Bitcoin. Nearly every 7th SBL listing was for a botnet controller.

Most (68%) of the controllers discovered in 2017 were hosted on servers ordered by attackers for the sole purpose of hosting botnet controllers. These servers are put on Spamhaus' Botnet Controller List, which helps networks avoid traffic to/from botnets -- because none of these IP addresses host legitimate services, they can be directly blocked on corporate networks without affecting real traffic. Spamhaus blacklisted an average of 600-700 servers per month in 2017.

Lawrence Orans, research vice president at Gartner with a focus on network security, says when it comes to botnets, most businesses are concerned about DDoS attacks.

"A shift in botnet activity came in the end of 2016, in September and October, with the emergence of the Mirai botnet and how that was used in a high-profile DDoS attack," he explains. DDoSes remain the biggest botnet-related threat corporations face, and they should have mitigation capabilities in place from a service provider or content delivery network.

According to Spamhaus research, a standout trend from 2017 is the marked increase of botnet controllers hosted on legitimate cloud services. Most are on Amazon Web Services: Amazon alone hosted 303 C&C servers in 2017 compared with 36 in 2016. However, analysis from earlier this year found Google's cloud platform Compute Engine is also hosting more botnets.

Orans says this isn't necessarily a "game-changing shift" given many modern security tools are designed to detect callbacks to C&C servers. Detection wouldn't be affected regardless of server location, he says.

Spamhaus notes some cloud providers have begun to deal with the problem of fake sign-ups, but others still struggle with the issue. Major cloud providers are "overwhelmed" by the large amount of fraudulent sign-ups on their networks in 2017, researchers explain.

Fraudulent sign-ups are one part of the growing botnet problem. Compromised servers and websites are another. It's tough for ISPs or hosting providers to prevent compromise because servers and websites are mostly under customer control and many run outdated software. Cybercriminals can easily scan the Internet for these; open-source content management systems like WordPress, Drupal, Joomla, and Typo3 are all popular targets, Spamhaus reports.

Most malware associated with botnet controllers detected in 2017 were banking Trojans, particularly Chthonic, Gozi, Heodo, TrickBot, Dridex, Worm.Ramnit, AZORult, and PandaZeuS. Droppers/credential stealers were also common: Downloader.Pony, Loki, Smoke Loader, and Neutrino. Criminals also often distributed IoT malware, ransomware, and backdoors.

Spamhaus anticipates the growth of IoT threats will likely continue in 2018, and Orans agrees.

"For example, many home appliances lag in security protection, so they can be easily compromised by malware and become part of a botnet," he says. "This is what we saw with the Mirai botnet in 2016."

Further, Orans emphasizes the importance of knowing how to respond if your business is targeted with a DDoS attack. "Who's going to interface with the public? Who's going to interface with executives? You should have a playbook in place for a botnet-generated DDoS attack," he says.

The person who interfaces with the board, and the public, following an attack will depend on the company's size. Generally the person who speaks with the public will not be the security leader, Orans explains, but a communications professional or public relations representative.

Related Content:

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance & Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
One in Three SOC Analysts Now Job-Hunting
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/12/2018
Encrypted Attacks Continue to Dog Perimeter Defenses
Ericka Chickowski, Contributing Writer, Dark Reading,  2/14/2018
Can Android for Work Redefine Enterprise Mobile Security?
Satish Shetty, CEO, Codeproof Technologies,  2/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: One agent too many was installed on Bob's desktop.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.