Threat Intelligence

2/23/2017
04:40 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Russia Top Source Of Nefarious Internet Traffic

Honeypot research from F-Secure shows majority of illicit online activity coming from IP addresses in Russia - also where ransomware is a hot commodity.

A global research honeypot tracked what appeared to be a large amount of reconnaissance traffic coming from Russian IP addresses in the second half of last year: some 60% of the overall volume of traffic came from Russia.

The second-closest region was the Netherlands, with 11% of the overall traffic, followed by the US (9%); Germany (4%); and China (4%), according to data culled from F-Secure's global honeypot network, which provides a snapshot of just where attack attempts, recon, and other nefarious activity is originating – and targeting.

F-Secure found that close to half of the traffic was searching for exposed HTTP and HTTPS ports, most likely for the purpose of seeking out vulnerable software to exploit and spread malware, or compromise the targeted device. These systems then can be used as proxies for other attacks, for instance. Simple Main Transfer Protocol (SMTP) ports were also high on the recon radar screen.

"With Russia being the largest source of this traffic, it’s no surprise that most countries in the world were targeted by Russian IPs, including Russia," F-Secure said in its newly published annual threat report. "The US was the most frequent target of both global and Russian traffic."

Most ransomware activity comes out of Russia as well, noted Mikko Hypponen, chief research officer for F-Secure in a press briefing during the RSA Conference last week in San Francisco. There are more than 100 ransomware gangs, he said, and some operate out of Ukraine.

Russian-speaking cybercrime gangs and individuals account for 80% of ransomware families seen in the last 12 months, Kaspersky Lab data shows. The ransomware attackers are a combination of skilled developers to script kiddies, all cashing in on the ease and relative anonymity of cyber-extortion attacks that now come in easy-to-use-kits. Some are making tens of thousands of dollars a day via ransomware attacks, according to Kaspersky Lab.

Hypponen expects ransomware incidents to get worse. "One of the things making it worse is that it's becoming so decentralized. There are so many different gangs making money on ransomware, and they are competing," he said.

They have sophisticated application interfaces that help them track their campaigns and how successful they were; some even provide customer support to help the victim get bitcoin for ransom payment. He showed one campaign's interface indicating it had a conversion rate of 16% success.

Other security experts last week echoed Hypponen's prediction that ransomware would escalate, and get uglier: not only are the attackers getting more aggressive and strict about payment deadlines, but some attack a victim multiple times, even after he or she pays up. "Traditional blackmailers know if someone pays once, they are probably going to pay again," said James Lyne, global head of security research at Sophos Labs.

Look for ransomware attacks that also steal, damage, or wipe data, so even if a victim pays the ransom, his or her data is still at risk or lost forever.

Related Content:

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
kasstri
100%
0%
kasstri,
User Rank: Strategist
2/27/2017 | 10:35:11 AM
keyboard
I understand and expect from east Europe but Netherlands is really surprising
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:50:38 PM
Re: is it Russia, really?
" if someone became insane Mr. Putin is to blame". I would not think that it is about a person, mainly is about a network of hackers.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:49:24 PM
Re: is it Russia, really?
"US administration became concerned that one day the Russians will become as skilled as the American " I think they are already as skillful as anybody else.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:46:35 PM
Re: is it Russia, really?
"internet has given him a weapon that he can use offensively." As I just said, the same for almost all other countries. Internet became the platform of cyber wars.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:44:31 PM
Re: is it Russia, really?
"Especially when most of the traffic goes via CIA-controlled " The same in many other countries once hit the servers they have a control the traffic is most likely being monitored carefully.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:41:59 PM
Re: is it Russia, really?
"how easiy it is to spoof IP address." That makes sense, IP can easily be spoofed and that is what hackers would be doing in the first place.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:39:58 PM
Lost money and data
Article mentioned "even if a victim pays the ransom, his or her data is still at risk or lost forever." This is the worst case scenario, you lost money and data at the same time.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:38:35 PM
ransomware incidents to get worse
I agree wit this. Ransomware incidents to get worse since some companies really pay for it and that encourages the hackers further.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:37:06 PM
60% vs. 11%
So 60% is Russians and 11% is Netherlands. That is a big difference
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:36:00 PM
Netherlands?
Netherlands is quite surprising for me, I understand and expect from east Europe but Netherlands is really surprising .
Page 1 / 2   >   >>
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.