Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

5/29/2014
12:55 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

FireEye: Malware Traffic to Ukraine, Russia Spiked During Peak of Conflict

A FireEye researcher posits that a significant spike in malware traffic to Russia and the Ukraine at the height of the conflict between the two countries could be part of a trend -- and could improve threat intelligence.

Malware traffic traced back to the Ukraine and Russia spiked in March at the height of the conflict between the two countries, according to FireEye. Kenneth Geers, senior global threat analyst for FireEye, theorizes that there is a distinct correlation between this cyber activity and the crucial geopolitical situation -- and he is now digging deeper into historical data to see if the Russia-Ukraine malware spike is part of a trend. If it is, this could be another asset to threat intelligence.

In March, Russia's parliament authorized the use of military force in Ukraine. Vladimir Putin signed a bill incorporating the Crimean peninsula into the Russian Federation, and Russian military forces massed along the Ukrainian border.

Callbacks to the Ukraine steadily increased leading up to those events. According to FireEye's data, in March 2013, Ukraine only ranked 14th on the list of top countries to receive first-stage malware callbacks. In March 2014 it leaped to ninth place. Similarly, FireEye detected 30 million callbacks to Russia over the past 16 months. In February, Russia ranked seventh on the list of top 20 countries to receive first-stage malware callbacks; in March, it jumped to third place.

As Geers explained in a blog post yesterday:

    What I want to convey in this blog is that generic, high-level traffic analysis -- for which it is not always necessary to know the exact content or the original source of individual communications -- might be used to draw a link between large-scale malware activity and important geopolitical events. In other words, the rise in callbacks to Russia and Ukraine (or to any other country or region of the world) during high levels of geopolitical tension suggests strongly that computer network operations are being used as one way to gain competitive advantage in the conflict.

Geers says that it's logical to imagine that the activities of both nation-state actors trying to gain the upper hand and opportunistic financially driven attackers capitalizing on a bad situation would increase during major geopolitical events.

The extra traffic probably includes "a little bit of everything," he says, "and in that everything are government hackers fulfilling national security requirements." If a country is on the brink of war, its need for intelligence and counterintelligence increases, causing government hackers to act with more urgency and less regard for obfuscation.

Geers says he's received some pushback from his colleagues within FireEye, who argue that, without knowing more about the content of the malware traffic and without attribution, it's dangerous to speculate that there is a correlation. He acknowledges their criticisms, and he is being careful not to make any grandiose proclamations yet. "This is just a baby step."

He also argues that the traffic analysis itself has strategic use, even in the absence of "attribution" in the traditional sense. He compares it to watching trucks. For example, during World War II, the US military discovered a crucial German tactical site simply by seeing how much traffic was going in that direction. Plus, the old reporters' maxim "follow the pizzas" suggests that you know something big is happening when you see trucks delivering hundreds of pizzas to the White House late at night.

Geers is enlisting the help of other researchers at FireEye to drill deeper and analyze historical data to see if the Ukraine-Russia situation is indeed a trend, and how that information could be used tactically.

"You can find cyber operations that will tip you off to something coming, a pending attack," he says. "Cyber activity is usually a reflection of real-world activity. You have to inform each with some knowledge of the other. Cyber war, for lack of a better term, is part of the landscape now."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Susan Fourtan
50%
50%
Susan Fourtan,
User Rank: Apprentice
5/30/2014 | 4:39:26 AM
Historical data and following the pizzas at night
Sara, 

Historical data can certainly tell if that suspicion that there is a correlation between cyber activity and the geopolitical situation. If there is a trend building a defense would be easier. 

When I read the part about following the pizzas to the White House at night I remembered I have somewhere a picture of the Red Phone that was in the secret headquarters of the KGB that were operating on a secret floor in a hotel in Tallinn, Estonia.

Not long ago they opened the floor for an exhibition of secret espionage in those days and the red phone was part of the collection together with documentation and other secret devices. 

-Susan 

 

 

 

 

 
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
5/30/2014 | 1:37:49 AM
Where There's Smoke
I agree that it is dangerous to speculate without very specific evidence.  That said, as a tool for aiding in understanding response to change, I see no reason why a correlation shouldn't be drawn.  I suspect reports like this will become the norm of geo-political reporting and at some point, tools utilized in UN summits.


I'd be curious to see the traffic analysis results broken out in fine detail.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15058
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
CVE-2020-15059
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
CVE-2020-15060
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15061
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
CVE-2020-15062
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.