Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

1/10/2018
05:03 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

AWS, Google Cloud Popular Home for Botnet Controllers

The number of command-and-control listings increase 32% in 2017, with more botnet controllers hosted in the cloud.

Botnet controllers increased by 32% in 2017, and more cybercriminals are taking advantage of legitimate cloud providers like Amazon and Google to host them, researchers report.

The team at Spamhaus Malware Labs this week published its 2017 Botnet Threat Report, which digs into the numbers and trends behind botnet threats encountered throughout the year. In 2017, the company identified and issued Spamhaus Block List (SBL) listings for more than 9,500 botnet command-and-control (C&C) servers on 1,122 different networks. SBL refers to a database of IP addresses from which the organization doesn't recommend accepting mail.

As a means to control malware-infected machines and exfiltrate data, C&C servers play a critical role in operations to distribute spam, ransomware, and banking Trojans, launch DDoS attacks, and mine cryptocurrencies like Bitcoin. Nearly every 7th SBL listing was for a botnet controller.

Most (68%) of the controllers discovered in 2017 were hosted on servers ordered by attackers for the sole purpose of hosting botnet controllers. These servers are put on Spamhaus' Botnet Controller List, which helps networks avoid traffic to/from botnets -- because none of these IP addresses host legitimate services, they can be directly blocked on corporate networks without affecting real traffic. Spamhaus blacklisted an average of 600-700 servers per month in 2017.

Lawrence Orans, research vice president at Gartner with a focus on network security, says when it comes to botnets, most businesses are concerned about DDoS attacks.

"A shift in botnet activity came in the end of 2016, in September and October, with the emergence of the Mirai botnet and how that was used in a high-profile DDoS attack," he explains. DDoSes remain the biggest botnet-related threat corporations face, and they should have mitigation capabilities in place from a service provider or content delivery network.

According to Spamhaus research, a standout trend from 2017 is the marked increase of botnet controllers hosted on legitimate cloud services. Most are on Amazon Web Services: Amazon alone hosted 303 C&C servers in 2017 compared with 36 in 2016. However, analysis from earlier this year found Google's cloud platform Compute Engine is also hosting more botnets.

Orans says this isn't necessarily a "game-changing shift" given many modern security tools are designed to detect callbacks to C&C servers. Detection wouldn't be affected regardless of server location, he says.

Spamhaus notes some cloud providers have begun to deal with the problem of fake sign-ups, but others still struggle with the issue. Major cloud providers are "overwhelmed" by the large amount of fraudulent sign-ups on their networks in 2017, researchers explain.

Fraudulent sign-ups are one part of the growing botnet problem. Compromised servers and websites are another. It's tough for ISPs or hosting providers to prevent compromise because servers and websites are mostly under customer control and many run outdated software. Cybercriminals can easily scan the Internet for these; open-source content management systems like WordPress, Drupal, Joomla, and Typo3 are all popular targets, Spamhaus reports.

Most malware associated with botnet controllers detected in 2017 were banking Trojans, particularly Chthonic, Gozi, Heodo, TrickBot, Dridex, Worm.Ramnit, AZORult, and PandaZeuS. Droppers/credential stealers were also common: Downloader.Pony, Loki, Smoke Loader, and Neutrino. Criminals also often distributed IoT malware, ransomware, and backdoors.

Spamhaus anticipates the growth of IoT threats will likely continue in 2018, and Orans agrees.

"For example, many home appliances lag in security protection, so they can be easily compromised by malware and become part of a botnet," he says. "This is what we saw with the Mirai botnet in 2016."

Further, Orans emphasizes the importance of knowing how to respond if your business is targeted with a DDoS attack. "Who's going to interface with the public? Who's going to interface with executives? You should have a playbook in place for a botnet-generated DDoS attack," he says.

The person who interfaces with the board, and the public, following an attack will depend on the company's size. Generally the person who speaks with the public will not be the security leader, Orans explains, but a communications professional or public relations representative.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.
CVE-2020-7222
PUBLISHED: 2020-01-18
An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter (to true) in this JavaScript code can bypass authentication and achieve limited privileges (...