Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/23/2017
04:40 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Russia Top Source Of Nefarious Internet Traffic

Honeypot research from F-Secure shows majority of illicit online activity coming from IP addresses in Russia - also where ransomware is a hot commodity.

A global research honeypot tracked what appeared to be a large amount of reconnaissance traffic coming from Russian IP addresses in the second half of last year: some 60% of the overall volume of traffic came from Russia.

The second-closest region was the Netherlands, with 11% of the overall traffic, followed by the US (9%); Germany (4%); and China (4%), according to data culled from F-Secure's global honeypot network, which provides a snapshot of just where attack attempts, recon, and other nefarious activity is originating – and targeting.

F-Secure found that close to half of the traffic was searching for exposed HTTP and HTTPS ports, most likely for the purpose of seeking out vulnerable software to exploit and spread malware, or compromise the targeted device. These systems then can be used as proxies for other attacks, for instance. Simple Main Transfer Protocol (SMTP) ports were also high on the recon radar screen.

"With Russia being the largest source of this traffic, it’s no surprise that most countries in the world were targeted by Russian IPs, including Russia," F-Secure said in its newly published annual threat report. "The US was the most frequent target of both global and Russian traffic."

Most ransomware activity comes out of Russia as well, noted Mikko Hypponen, chief research officer for F-Secure in a press briefing during the RSA Conference last week in San Francisco. There are more than 100 ransomware gangs, he said, and some operate out of Ukraine.

Russian-speaking cybercrime gangs and individuals account for 80% of ransomware families seen in the last 12 months, Kaspersky Lab data shows. The ransomware attackers are a combination of skilled developers to script kiddies, all cashing in on the ease and relative anonymity of cyber-extortion attacks that now come in easy-to-use-kits. Some are making tens of thousands of dollars a day via ransomware attacks, according to Kaspersky Lab.

Hypponen expects ransomware incidents to get worse. "One of the things making it worse is that it's becoming so decentralized. There are so many different gangs making money on ransomware, and they are competing," he said.

They have sophisticated application interfaces that help them track their campaigns and how successful they were; some even provide customer support to help the victim get bitcoin for ransom payment. He showed one campaign's interface indicating it had a conversion rate of 16% success.

Other security experts last week echoed Hypponen's prediction that ransomware would escalate, and get uglier: not only are the attackers getting more aggressive and strict about payment deadlines, but some attack a victim multiple times, even after he or she pays up. "Traditional blackmailers know if someone pays once, they are probably going to pay again," said James Lyne, global head of security research at Sophos Labs.

Look for ransomware attacks that also steal, damage, or wipe data, so even if a victim pays the ransom, his or her data is still at risk or lost forever.

Related Content:

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
kasstri
100%
0%
kasstri,
User Rank: Strategist
2/27/2017 | 10:35:11 AM
keyboard
I understand and expect from east Europe but Netherlands is really surprising
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:50:38 PM
Re: is it Russia, really?
" if someone became insane Mr. Putin is to blame". I would not think that it is about a person, mainly is about a network of hackers.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:49:24 PM
Re: is it Russia, really?
"US administration became concerned that one day the Russians will become as skilled as the American " I think they are already as skillful as anybody else.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:46:35 PM
Re: is it Russia, really?
"internet has given him a weapon that he can use offensively." As I just said, the same for almost all other countries. Internet became the platform of cyber wars.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:44:31 PM
Re: is it Russia, really?
"Especially when most of the traffic goes via CIA-controlled " The same in many other countries once hit the servers they have a control the traffic is most likely being monitored carefully.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:41:59 PM
Re: is it Russia, really?
"how easiy it is to spoof IP address." That makes sense, IP can easily be spoofed and that is what hackers would be doing in the first place.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:39:58 PM
Lost money and data
Article mentioned "even if a victim pays the ransom, his or her data is still at risk or lost forever." This is the worst case scenario, you lost money and data at the same time.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:38:35 PM
ransomware incidents to get worse
I agree wit this. Ransomware incidents to get worse since some companies really pay for it and that encourages the hackers further.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:37:06 PM
60% vs. 11%
So 60% is Russians and 11% is Netherlands. That is a big difference
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2017 | 7:36:00 PM
Netherlands?
Netherlands is quite surprising for me, I understand and expect from east Europe but Netherlands is really surprising .
Page 1 / 2   >   >>
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15540
PUBLISHED: 2019-08-25
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
CVE-2019-15538
PUBLISHED: 2019-08-25
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a ...
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.