Threat Intelligence

2/23/2017
04:40 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Russia Top Source Of Nefarious Internet Traffic

Honeypot research from F-Secure shows majority of illicit online activity coming from IP addresses in Russia - also where ransomware is a hot commodity.

A global research honeypot tracked what appeared to be a large amount of reconnaissance traffic coming from Russian IP addresses in the second half of last year: some 60% of the overall volume of traffic came from Russia.

The second-closest region was the Netherlands, with 11% of the overall traffic, followed by the US (9%); Germany (4%); and China (4%), according to data culled from F-Secure's global honeypot network, which provides a snapshot of just where attack attempts, recon, and other nefarious activity is originating – and targeting.

F-Secure found that close to half of the traffic was searching for exposed HTTP and HTTPS ports, most likely for the purpose of seeking out vulnerable software to exploit and spread malware, or compromise the targeted device. These systems then can be used as proxies for other attacks, for instance. Simple Main Transfer Protocol (SMTP) ports were also high on the recon radar screen.

"With Russia being the largest source of this traffic, it’s no surprise that most countries in the world were targeted by Russian IPs, including Russia," F-Secure said in its newly published annual threat report. "The US was the most frequent target of both global and Russian traffic."

Most ransomware activity comes out of Russia as well, noted Mikko Hypponen, chief research officer for F-Secure in a press briefing during the RSA Conference last week in San Francisco. There are more than 100 ransomware gangs, he said, and some operate out of Ukraine.

Russian-speaking cybercrime gangs and individuals account for 80% of ransomware families seen in the last 12 months, Kaspersky Lab data shows. The ransomware attackers are a combination of skilled developers to script kiddies, all cashing in on the ease and relative anonymity of cyber-extortion attacks that now come in easy-to-use-kits. Some are making tens of thousands of dollars a day via ransomware attacks, according to Kaspersky Lab.

Hypponen expects ransomware incidents to get worse. "One of the things making it worse is that it's becoming so decentralized. There are so many different gangs making money on ransomware, and they are competing," he said.

They have sophisticated application interfaces that help them track their campaigns and how successful they were; some even provide customer support to help the victim get bitcoin for ransom payment. He showed one campaign's interface indicating it had a conversion rate of 16% success.

Other security experts last week echoed Hypponen's prediction that ransomware would escalate, and get uglier: not only are the attackers getting more aggressive and strict about payment deadlines, but some attack a victim multiple times, even after he or she pays up. "Traditional blackmailers know if someone pays once, they are probably going to pay again," said James Lyne, global head of security research at Sophos Labs.

Look for ransomware attacks that also steal, damage, or wipe data, so even if a victim pays the ransom, his or her data is still at risk or lost forever.

Related Content:

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
kasstri
100%
0%
kasstri,
User Rank: Strategist
2/27/2017 | 10:35:11 AM
keyboard
I understand and expect from east Europe but Netherlands is really surprising
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:50:38 PM
Re: is it Russia, really?
" if someone became insane Mr. Putin is to blame". I would not think that it is about a person, mainly is about a network of hackers.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:49:24 PM
Re: is it Russia, really?
"US administration became concerned that one day the Russians will become as skilled as the American " I think they are already as skillful as anybody else.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:46:35 PM
Re: is it Russia, really?
"internet has given him a weapon that he can use offensively." As I just said, the same for almost all other countries. Internet became the platform of cyber wars.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:44:31 PM
Re: is it Russia, really?
"Especially when most of the traffic goes via CIA-controlled " The same in many other countries once hit the servers they have a control the traffic is most likely being monitored carefully.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:41:59 PM
Re: is it Russia, really?
"how easiy it is to spoof IP address." That makes sense, IP can easily be spoofed and that is what hackers would be doing in the first place.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:39:58 PM
Lost money and data
Article mentioned "even if a victim pays the ransom, his or her data is still at risk or lost forever." This is the worst case scenario, you lost money and data at the same time.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:38:35 PM
ransomware incidents to get worse
I agree wit this. Ransomware incidents to get worse since some companies really pay for it and that encourages the hackers further.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:37:06 PM
60% vs. 11%
So 60% is Russians and 11% is Netherlands. That is a big difference
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:36:00 PM
Netherlands?
Netherlands is quite surprising for me, I understand and expect from east Europe but Netherlands is really surprising .
Page 1 / 2   >   >>
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I'm not sure I like this top down management approach!"
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17332
PUBLISHED: 2018-09-22
An issue was discovered in libsvg2 through 2012-10-19. The svgGetNextPathField function in svg_string.c returns its input pointer in certain circumstances, which might result in a memory leak caused by wasteful malloc calls.
CVE-2018-17333
PUBLISHED: 2018-09-22
An issue was discovered in libsvg2 through 2012-10-19. A stack-based buffer overflow in svgStringToLength in svg_types.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because sscanf is misused.
CVE-2018-17334
PUBLISHED: 2018-09-22
An issue was discovered in libsvg2 through 2012-10-19. A stack-based buffer overflow in the svgGetNextPathField function in svg_string.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because a strncpy copy limit is miscalculated.
CVE-2018-17336
PUBLISHED: 2018-09-22
UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n...
CVE-2018-17321
PUBLISHED: 2018-09-22
An issue was discovered in SeaCMS 6.64. XSS exists in admin_datarelate.php via the time or maxHit parameter in a dorandomset action.