Tag: botnets | Page 2

En 2023 aumentó la actividad maliciosa de botnets IoT: Nokia

October 28, 2023/in Internet Security

Nokia presentó su estudio global de amenazas de seguridad denominado Nokia Threat Intelligence Report 2023. Para realizar el informe, la compañía tecnológica utilizó los datos del tráfico de red de más de 200 millones de dispositivos en todo el mundo.

Asimismo, se basó en la experiencia de especialistas de varias oficinas de Nokia en Canadá, Francia e India, una de ellas especializada en las aplicaciones de software sobre análisis de red y seguridad DDoS.

El reporte evidenció un gran aumento en la actividad maliciosa de botnets IoT, así como su forma de operación. En Tech Bit te contamos más sobre sus hallazgos.

Leer también: Qué pasa si dejas conectado el cargador del celular todo el tiempo

El crecimiento de la actividad maliciosa no fue lo único preocupante de entre los hallazgos de Nokia. El estudio identificó que organizaciones han pasado más de una década realizando ataques a operadores de telecomunicaciones. La situación se agrava al saber que cada año surgen nuevos grupos.

El informe también reveló la forma en la que han operado este tipo de amenazas de malware. La práctica más común es el escaneo para detectar dispositivos vulnerables. Su recurrencia es tal que representó el 90% de los ataques en redes móviles y el 88% en redes fijas. A través de éste se busca engañar a los usuarios para que ellos mismos instalen un malware.

Ad-clic bots, cripto-mineros y troyanos bancarios son los malware más comunes, de acuerdo con Nokia. Mientras que los primeros disminuyeron un 25% y los segundos se mantuvieron estables, los últimos se duplicaron.

Los troyanos bancarios harán lo posible para robar los datos de identidad del usuario con el fin de obtener el dinero de sus cuentas o realizar cargos fraudulentos en sus tarjetas de crédito. Este tipo de malware es uno de los más conocidos por ser un código de software disfrazado como otro producto seguro para su uso.

Los botnets son redes de dispositivos controlados de forma maliciosa por terceros. El reporte de Nokia identificó que han experimentado un gran aumento, por lo que actualmente son la principal forma de lanzar ataques DDoS (Denegación de Servicio).

Este crecimiento no está aislado, pues tiene…

Source…

APTs, botnets combated by new AWS system

October 3, 2023/in Internet Security

Nation state-sponsored advanced persistent threats Sandworm and Volt Typhoon and various distributed denial-of-service botnets were noted by Amazon Web Services to have been thwarted using its new MadPot internal threat intelligence decoy system, reports SecurityWeek.

Over 100 million possible threats are being tracked by MadPot using sensors and automotive response functionality, with nearly half a million of which being categorized as malicious, according to AWS.

Russian APT operation Sandworm was discovered by MadPot after attempted exploitation of a WatchGuard network security appliance vulnerability, with further examination of the payload yielding unique threat actor attributes and IP addresses.

On the other hand, MadPot was able to avert Chinese APT Volt Typhoon following an attack against U.S. territory Guam.

“Through our investigation inside MadPot, we identified a payload submitted by the threat actor that contained a unique signature, which allowed identification and attribution of activities by Volt Typhoon that would otherwise appear to be unrelated,” said AWS, which added that data and findings from the MadPot system have been leveraged to strengthen its security offerings.

Source…

Demystifying Botnets: Understanding the Anatomy of a Cyber Threat | by Dwayne Wong (Omowale) | Jul, 2023

July 16, 2023/in Computer Security

Botnets are networks of computers that are controlled by a central server. The computers in a botnet are called bots, and they can be infected with malware without the user’s knowledge. Once a bot is infected, it becomes part of the botnet and can be used for various malicious activities. The central server that controls the botnet is called the Command and Control (C&C) server. The C&C server sends instructions to the bots, which then carry out the commands.

Botnets are used for a variety of malicious purposes, including launching DDoS attacks, sending spam, spreading malware, and stealing sensitive information. DDoS attacks are one of the most common uses of botnets. In a DDoS attack, the bots in the botnet send a flood of traffic to a target server, which overwhelms the server and causes it to crash. This can result in significant downtime and financial losses for the victim.

Botnets work by infecting computers with malware, which then allows the central server to control the infected computers. The malware used to infect the computers can be delivered in various ways, including through email attachments, malicious websites, and software vulnerabilities. Once a computer is infected, it becomes a bot and can be controlled by the C&C server.

The C&C server sends instructions to the bots, which can include launching DDoS attacks, stealing sensitive information, or spreading malware. The bots receive their instructions through a command protocol, which can be encrypted to make it difficult to detect. The bots can also communicate with each other, which allows them to coordinate their attacks.

There are several types of botnets, each with its unique characteristics and methods of operation. Some of the most common types of botnets include:

IRC botnets are one of the oldest types of botnets and are still in use today. They use Internet Relay Chat (IRC) channels for communication between the bots and the C&C server. The bots connect to the IRC channel and wait for instructions from the C&C server.

Source…