{"id":43439,"date":"2021-10-15T15:01:31","date_gmt":"2021-10-15T15:01:31","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/32727\/Spamhaus-Botnet-Threat-Update-Q3-2021.html"},"modified":"2021-10-15T15:01:31","modified_gmt":"2021-10-15T15:01:31","slug":"spamhaus-botnet-threat-update-q3-2021","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/spamhaus-botnet-threat-update-q3-2021\/","title":{"rendered":"Spamhaus Botnet Threat Update: Q3-2021"},"content":{"rendered":"

<\/p>\n

Q3 has seen a massive 82% rise in the number of new botnet command and controllers (C&Cs) identified by our research team. They have observed an explosion in the use of backdoor malware with nefarious operators hiding behind FastFlux. In turn, this has caused several new countries and service providers to be listed in our Top 20 charts. Welcome to the Spamhaus Botnet Threat Update Q3 2021.<\/strong><\/p>\n

<\/p>\n

FastFlux emerging again<\/h2>\n
\n

What is FastFlux?<\/h3>\n

FastFlux is a technique used by phishers, malware authors, and botnet operators to hide the actual location of their infrastructure behind a network of compromised hosts that are acting as a proxy, forwarding the malicious traffic to the real backend.<\/p>\n<\/p><\/div>\n

After analyzing this quarter\u2019s statistics, it is evident that FastFlux is once again rising in popularity. Here\u2019s a quick FastFlux refresher, including a deeper dive into how cybercriminals use it to make their infrastructure resilient against takedowns. <\/p>\n

What makes FastFl to cybercriminals?<\/h3>\n

All FastFlux networks that are currently in business can be rented as a service on the dark web. This makes life easy for botnet operators. All they have to do is register domains required for the botnet C&Cs and point them to the FastFlux operator\u2019s service. FastFlux takes care of the rest, ensuring that the A records rapidly change.<\/p>\n

Here\u2019s an example of a FluBot botnet C&C domain hosted on a FastFlux botnet:\n<\/p>\n

\n;; QUESTION SECTION:\n;gurbngbcxheshsj.ru. IN A ;; ANSWER SECTION:\nDomain TTL RecordType IP Address\ngurbngbcxheshsj.ru. 150 IN A 189.165.94.67\ngurbngbcxheshsj.ru. 150 IN A 124.109.61.160\ngurbngbcxheshsj.ru. 150 IN A 187.190.48.60\ngurbngbcxheshsj.ru. 150 IN A 115.91.217.231\ngurbngbcxheshsj.ru. 150 IN A 175.126.109.15\ngurbngbcxheshsj.ru. 150 IN A 175.119.10.231\ngurbngbcxheshsj.ru. 150 IN A 218.38.155.210\ngurbngbcxheshsj.ru. 150 IN A 179.52.22.168\ngurbngbcxheshsj.ru. 150 IN A 113.11.118.155\ngurbngbcxheshsj.ru. 150 IN A 14.51.96.70\n<\/pre>\n
As you can see, the botnet C&C domain uses ten concurrent A records with a time to live (TTL) of only 150 seconds. Monitoring these A records reveals that the underlying FastFlux botnet consists of 100 to 150 active FastFlux nodes per day.<\/p>\n
Generally, these nodes are compromised devices, commonly Customer Premise Equipment (CPE), insecurely configured (e.g., running vulnerable software or using standard login credentials), and accessible directly from the internet.<\/p>\n
These kinds of devices are a soft target for cybercriminals. They simply need to conduct internet-wide scans to discover these vulnerable devices and compromise them. This whole process can all be automated, making it quick, easy, and effective.<\/p>\n
 Operators of FastFlux botnets choose the geolocation of their target devices they use for FastFlux hosting carefully. As you will notice when reading through this report, many FastFlux C&C nodes are hosted in places that are relatively well \u201cdigitized,\u201d i.e., have good internet connections but are not as advanced along the maturity curve in terms of cybersecurity. <\/p>\n
Latin America is commonly a target, e.g., Brazil, Chile, Argentina, Uruguay, and Asian countries such as Korea. The newcomers to the geolocation statistics in this update reflect this.<\/p>\n
  <\/p>\n
Number of botnet C&Cs observed, Q3 2021<\/h2>\n
In Q3 2021, Spamhaus Malware Labs identified 2,656 botnet C&Cs compared to 1,462 in Q2 2021. This was an 82% increase quarter on quarter! The monthly average increased from 487 per month in Q2 to 885 botnet C&Cs per month in Q3.<\/p>\n\n\n\n
<\/td>\n<\/tr>\n
<\/td>\n<\/tr>\n<\/table>\n
  <\/p>\n
Geolocation of botnet C&Cs, Q3 2021<\/h2>\n
Given FastFlux\u2019s influence over the past quarter, it isn\u2019t surprising that there\u2019s a clear pattern to the newcomers entering the chart for Q3 2021. Many of the countries joining the charts were responsible for hosting a large percentage of TeamBot, and FluBot botnet C&C servers – utilizing Fastflux – and fit the profile of countries with extensive internet coverage but less security-focused.<\/p>\n
Significant increases in Russia<\/h3>\n
The number of botnet C&Cs located in Russia has dramatically risen. This is the second increase quarter on quarter that Russia has experienced:\n<\/p>\n