Cloud

1/10/2018
05:03 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

AWS, Google Cloud Popular Home for Botnet Controllers

The number of command-and-control listings increase 32% in 2017, with more botnet controllers hosted in the cloud.

Botnet controllers increased by 32% in 2017, and more cybercriminals are taking advantage of legitimate cloud providers like Amazon and Google to host them, researchers report.

The team at Spamhaus Malware Labs this week published its 2017 Botnet Threat Report, which digs into the numbers and trends behind botnet threats encountered throughout the year. In 2017, the company identified and issued Spamhaus Block List (SBL) listings for more than 9,500 botnet command-and-control (C&C) servers on 1,122 different networks. SBL refers to a database of IP addresses from which the organization doesn't recommend accepting mail.

As a means to control malware-infected machines and exfiltrate data, C&C servers play a critical role in operations to distribute spam, ransomware, and banking Trojans, launch DDoS attacks, and mine cryptocurrencies like Bitcoin. Nearly every 7th SBL listing was for a botnet controller.

Most (68%) of the controllers discovered in 2017 were hosted on servers ordered by attackers for the sole purpose of hosting botnet controllers. These servers are put on Spamhaus' Botnet Controller List, which helps networks avoid traffic to/from botnets -- because none of these IP addresses host legitimate services, they can be directly blocked on corporate networks without affecting real traffic. Spamhaus blacklisted an average of 600-700 servers per month in 2017.

Lawrence Orans, research vice president at Gartner with a focus on network security, says when it comes to botnets, most businesses are concerned about DDoS attacks.

"A shift in botnet activity came in the end of 2016, in September and October, with the emergence of the Mirai botnet and how that was used in a high-profile DDoS attack," he explains. DDoSes remain the biggest botnet-related threat corporations face, and they should have mitigation capabilities in place from a service provider or content delivery network.

According to Spamhaus research, a standout trend from 2017 is the marked increase of botnet controllers hosted on legitimate cloud services. Most are on Amazon Web Services: Amazon alone hosted 303 C&C servers in 2017 compared with 36 in 2016. However, analysis from earlier this year found Google's cloud platform Compute Engine is also hosting more botnets.

Orans says this isn't necessarily a "game-changing shift" given many modern security tools are designed to detect callbacks to C&C servers. Detection wouldn't be affected regardless of server location, he says.

Spamhaus notes some cloud providers have begun to deal with the problem of fake sign-ups, but others still struggle with the issue. Major cloud providers are "overwhelmed" by the large amount of fraudulent sign-ups on their networks in 2017, researchers explain.

Fraudulent sign-ups are one part of the growing botnet problem. Compromised servers and websites are another. It's tough for ISPs or hosting providers to prevent compromise because servers and websites are mostly under customer control and many run outdated software. Cybercriminals can easily scan the Internet for these; open-source content management systems like WordPress, Drupal, Joomla, and Typo3 are all popular targets, Spamhaus reports.

Most malware associated with botnet controllers detected in 2017 were banking Trojans, particularly Chthonic, Gozi, Heodo, TrickBot, Dridex, Worm.Ramnit, AZORult, and PandaZeuS. Droppers/credential stealers were also common: Downloader.Pony, Loki, Smoke Loader, and Neutrino. Criminals also often distributed IoT malware, ransomware, and backdoors.

Spamhaus anticipates the growth of IoT threats will likely continue in 2018, and Orans agrees.

"For example, many home appliances lag in security protection, so they can be easily compromised by malware and become part of a botnet," he says. "This is what we saw with the Mirai botnet in 2016."

Further, Orans emphasizes the importance of knowing how to respond if your business is targeted with a DDoS attack. "Who's going to interface with the public? Who's going to interface with executives? You should have a playbook in place for a botnet-generated DDoS attack," he says.

The person who interfaces with the board, and the public, following an attack will depend on the company's size. Generally the person who speaks with the public will not be the security leader, Orans explains, but a communications professional or public relations representative.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Well, at least it isn't Mobby Dick!
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4035
PUBLISHED: 2019-03-22
IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X...
CVE-2019-4052
PUBLISHED: 2019-03-22
IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544.
CVE-2019-9648
PUBLISHED: 2019-03-22
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.
CVE-2019-9923
PUBLISHED: 2019-03-22
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
CVE-2019-9924
PUBLISHED: 2019-03-22
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.