{"id":44919,"date":"2022-01-21T15:20:59","date_gmt":"2022-01-21T15:20:59","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33026\/Spamhaus-Botnet-Threat-Update-Q4-2021.html"},"modified":"2022-01-21T15:20:59","modified_gmt":"2022-01-21T15:20:59","slug":"spamhaus-botnet-threat-update-q4-2021","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/spamhaus-botnet-threat-update-q4-2021\/","title":{"rendered":"Spamhaus Botnet Threat Update: Q4-2021"},"content":{"rendered":"

<\/p>\n

Q4 saw a 23% rise in the number of new botnet command and controllers (C&Cs) identified by our research team. Despite this increase, our researchers are aware of botnet C&C activity they cannot track due to communications being made via DNS over HTTPS (DoH). This is worrying and certainly tilts the scales in the cybercriminals\u2019 favor.<\/strong><\/p>\n

Welcome to the Spamhaus Botnet Threat Update Q4 2021.<\/strong><\/p>\n

<\/p>\n

The issues of DNS over HTTPS (DoH)<\/h2>\n

Remember FluBot & TeamBot from Q3?<\/h3>\n

Last quarter, we reported \u201can explosion in backdoor malware\u201d due to FluBot & TeamBot. In Q4, from the perspective of botnet C&C infrastructure Spamhaus observed, this malware family completely disappeared. However, this doesn\u2019t mean they weren\u2019t active. That is far from the truth \u2013 they were active!<\/p>\n

Why are they not being detected by Spamhaus?<\/h3>\n

This malware isn\u2019t appearing in our listings because those miscreants responsible for them have changed their operating procedures. Instead of making C&C communications using traditional HTTPS protocol, they use DNS over HTTPS (DoH) and abuse large DoH providers, including Google and Alibaba.<\/p>\n

Preventing abuse on the internet gets harder<\/h3>\n

While DoH was heralded with fanfares and touted as the next best security development of the internet, some security professionals (including Spamhaus) sighed as they realized the good guys would lose even more visibility over what the bad guys were doing. And by \u201ceven more,\u201d we refer to other issues like losing visibility of WHOIS data<\/a>.<\/p>\n

Why is DoH an issue?<\/h3>\n

DoH encrypts DNS traffic, making a resource private and secure that previously has always been public (unencrypted). You may be thinking that this has
\nto be a good thing, however as you can see, in this circumstance, our researchers have no visibility of FluBot & TeamBot\u2019s DNS requests. Consequently, we can\u2019t list the IP addresses, and therefore this data can\u2019t be used to protect users. While DoH is meant to be protecting the internet community, it is also enabling cybercriminals. It\u2019s a double-edged sword.<\/p>\n

Not only does DoH make hunting down miscreants even more challenging, but it also means that security products based around DNS monitoring and filtering could be less effective, which is far from ideal. Security issues are compounded due to major DoH providers not filtering harmful DNS resolutions of botnet, phishing or malware domains.<\/p>\n

<\/p>\n

Number of botnet C&Cs observed, Q4 2021<\/h2>\n

In Q4 2021, Spamhaus identified 3,271 botnet C&Cs compared to 2,656 in Q3 2021. This was a 23% increase quarter on quarter. The monthly average increased from 885 in Q3 to 1,090 botnet C&Cs per month in Q4.<\/p>\n\n\n
<\/td>\n<\/tr>\n<\/table>\n

<\/p>\n

Geolocation of botnet C&Cs, Q3 2021<\/h2>\n

Russia continues with significant increases<\/h3>\n

We reported last quarter that the number of botnet C&Cs in Russia had increased dramatically. However, this quarter saw even bigger increases:\n<\/p>\n