New white paper gives insight on Russian Business Network activities

A new white paper published by the nonprofit botnet-tracker Shadowserver Foundation sheds some light on one segment of activity on the Russian Business Network (RBN). (See Russian Business Network Disappears.)

Shadowserver released its findings on malware associated with the so-called AS40989 group of interconnected IP networks on the RBN. Shadowserver gathered nearly 3,000 sample pieces of malware -- including Gozi, Goldun, Hupigon, Nurech, Nuklus, Pinch, Sinowal, Tibs, Xorpix, as well as dialers, downloaders, worms, adware, page hijackers, and proxies -- that communicated with the AS40989 network via HTTP connections.

Security experts say RBN -- which recently disappeared off the Internet in what could be a retrenching move -- serves as an ISP and hosting service for Websites that deal in spam, identity theft, and other illegal activities. RBN in an interview with Wired last fall said that it's misunderstood, and denied wrongdoing.

Shadowserver observed in its research on RBN that RBN malware hosts appear to be professionally managed. "By 'professional' it is meant that rarely are malware back-ends misconfigured or open to inspection and, rarely do they generate errors or move from host to host," according to the report.

And RBN's business model was based on distributing software for spamming and stealing personal data, Shadowserver says. The nonprofit also makes a case for going public sooner about "known rogue networks, ASPs and ISPs" such as RBN.

"The initial audience of this paper knew about RBN and its practices long before any effective action was taken to remove the general threat it posed," Shadowserver says in its paper. And "breeding an atmosphere of intolerance toward networks which harbor criminal activities can be achieved with minimal to no impact to ongoing criminal investigations," the report says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Kelly Jackson Higgins, Editor-in-Chief, Dark Reading

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was recently selected as one of the Top 10 Cybersecurity Journalists in the US, and named as one of Folio's 2019 Top Women in Media. She began her career as a sports writer in the Washington, DC metropolitan area, and earned her BA at William & Mary. Follow her on Twitter @kjhiggins.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights