DOWNLOAD REPORT

CENTURYLINK 2018

THREAT REPORT

Threat intelligence is only useful if you can take action quickly to protect networks, systems and data. Read how CenturyLink gathers, analyzes and acts on threat data.

SHARE THIS EXPERIENCE

Understanding the Global Threat Landscape Puzzle

We are offering the IT community the unique insights we use to protect ourselves and our customers. This intelligence is based exclusively on what CenturyLink® Threat Research Labs sees across the CenturyLink global backbone.

We will show insights around the sources of global malicious traffic and the victims they target. We then breakdown the components of attack traffic by identifying the origins of command and control servers (C2s) and the bots they control. Finally, we present a deep dive into the presiding trends with respect to DDoS IoT botnets.

Malicious Traffic

Top 10 Countries Globally

1. The United States 2. Russia 3. China 4. Brazil 5. Ukraine 6. Germany 7. France 8. Netherlands 9. Turkey 10. United Kingdom

United States
Russia
China
Brazil
Ukraine
Germany
France
Netherlands
Turkey
United Kingdom

1

United States

2

Russia

3

China

4

Brazil

5

Ukraine

6

Germany

7

France

8

Netherlands

9

Turkey

10

United Kingdom

Click on the arrows to scroll through maps

C2s Directing Attacks by Country of Origin

Top 10 Countries Globally

1. The United States 2. Russia 3. Ukraine 4. China 5. Germany 6. Netherlands 7. France 8. United Kingdom 9. Brazil 10. Canada

1

United States

2

Russia

3

Ukraine

4

China

8

United Kingdom

5

Germany

7

France

6

Netherlands

9

Brazil

10

Canada

United States
Russia
Ukraine
China
Germany
Netherlands
France
United Kingdom
Brazil
Canada

Traffic between a network and any C2 server is a powerful risk indicator. Tracking C2 data reveals victim hotspots and activity hubs favored by malicious actors.

While the C2 breakdown matches closely to the overall malicious traffic by country, it is important to note the person controlling the C2 may not be located in the same country as the C2 server. The location of the C2 is driven by the mechanisms available to the bad actor.

Click on the arrows to scroll through maps

Top 5 Bot Hosting Countries

Daily Average

1.8m

United States

454k

China

248k

Brazil

158k

United Kingdom

147k

Germany

(Source: CenturyLink Threat Research Labs, Full Year 2017)

A bot can be a compromised server, computer or any IoT device such as a DVR, security camera, cell phone and so on. The most dangerous botnets contain hundreds of thousands of members waiting to attack at a moment’s notice.

Compromised Hosts (Bots)

In addition to the bad actors controlling the C2s and the botnets, it’s important to evaluate the targets of these attacks. Not only are countries and regions with robust communication infrastructure unknowingly supplying bandwidth for these attacks, but they are also the largest targets based on attack command volume.

Top 10 Countries Globally

1. The United States 2.China 3. Brazil 4. United Kingdom 5. Germany 6. Canada 7. Russia 8. France 9. Italy 10. India

1

United States

7

Russia

9

Italy

2

China

4

United Kingdom

5

Germany

8

France

6

Canada

3

Brazil

10

India

United States
China
Brazil
United Kingdom
Germany
Canada
Russia
France
Italy
India

Top 5 Targeted Countries Based on Attack Command Volume

Hit with Bot Traffic Full Year 2017

1. United States

2. China

3. Germany

4. Russia

5. United Kingdom

Top 5 Target Countries Based on Distribution of Attacks

Target Countries Full Year 2017

United States

China

Brazil

United Kingdom

Germany

A Review of DDoS IoT Botnets

Gafgyt and Mirai

The exploitation of IoT devices to create botnets for volumetric DDoS attacks began in earnest within the last several years.

As previously reported by the CenturyLink Threat Research Labs,

Gafgyt, a precursor to Mirai, started using IoT devices as botnets for DDoS attacks in 2014. Gafgyt (which also goes by the names BASHLITE, Lizkebab and Torlus) is a form of malware architected to infect Linux systems for the purpose of launching DDoS attacks.

C2 Count by Family – for Activity Tracked in 2017:

Gafgyt

562 unique C2s tracked in 2017

minimum uptime - one day, maximum uptime - 117 days.

Mirai

339 unique C2s tracked in 2017

minimum uptime - one day, maximum uptime - 83 days.

Active Days C2:

This chart tracks the top active C2s for the Gafgyt and Mirai botnet families and the length of time they’ve been active.

Gafgyt

Mirai

Back

2nd Half 2017

This chart reveals UDP and STD as the leading attack type for Gafgyt and Mirai based on our observations.

Gafgyt

Mirai

Back

Click here to find out how Mirai and Gafgyt work

How it works

Scanning for vulnerable devices is the basis for both botnets. Once vulnerable devices are identified, they are instructed to connect to a download server to install the malware. They then may be instructed to port scan for vulnerable devices or use external scanners to find and harvest new potential bots. In some cases, actors utilize the C2 servers themselves to scan and infect.

Mirai and Gafgyt have been tied to DDoS attacks against gaming servers, as well as perceived rivals of the owners of these botnets. Operators attempt to drive traffic to the gaming servers they control. According to Krebs on Security, a large, successful Minecraft server with more than a thousand players logging on each day can easily earn the server’s owners more than $50,000 per month.

Attack Commands Issued Total Per Month

2nd Half 2017

The CenturyLink Threat Research Labs Difference

CenturyLink Threat Research Labs culls its data from one of the world’s largest internet backbones, giving us tremendous depth to our field of vision when it comes to emerging and evolving cyber threats.

Unlike other security research entities, CenturyLink Threat Research Labs doesn’t just passively monitor malicious traffic flowing through the network; the team works to actively prevent bad actors from conducting criminal activities. The team identifies dozens of new C2s monthly and works with the upstream service providers to disable their services. If they are unable or unwilling to take action, then CenturyLink steps in and takes measures to protect our network and our customers.

back next

nearly

40 C2s

removed per month receive this enhanced treatment.

As one of the leading security research teams in the industry for tracking and reporting on botnets, and due to our unique view of the internet, CenturyLink contributes to several leading media outlets to inform the wider technology community about threats that may impact them, including Ars Technica, CSO, MIT Technology Review, PC Mag, Wall Street Journal, WIRED and many others.

back

VIDEO

Key Takeaways from the CenturyLink 2018 Threat Report

VIDEO

Hear highlights of the CenturyLink 2018 Threat Report from Mike Benjamin, head of CenturyLink Threat Research Labs

REPORT

CenturyLink 2018 Threat Report

REPORT

Read the full CenturyLink 2018 Threat Report

DOWNLOAD NOW

WHITE PAPER

Securing the Connected Enterprise Using Network-Based Security

WHITE PAPER

Explore IDC's report on the importance and benefits of network-based security

DOWNLOAD NOW

This document is provided for informational purposes only and may require additional research and substantiation by the end user. In addition, the information is provided “as is” without any warranty or condition of any kind, either express or implied. Use of this information is at the end user’s own risk. CenturyLink does not warrant that the information will meet the end user’s requirements or that the implementation or usage of this information will result in the desired outcome of the end user. This document represents CenturyLink’s products and offerings as of the date of issue. Services not available everywhere. Business customers only. CenturyLink may change or cancel products and services or substitute similar products and services at its sole discretion without notice. ©2018 CenturyLink. All Rights Reserved. The CenturyLink mark, pathways logo and certain CenturyLink product names are the property of CenturyLink. All other marks are the property of their respective owners.

CENTURYLINK 2018

THREAT REPORT

Threat intelligence is only useful if you can take action quickly to protect networks, systems and data. Read how CenturyLink gathers, analyzes and acts on threat data.

Understanding the Global Threat Landscape Puzzle

Malicious Traffic

Top 10 Countries Globally

1

2

3

4

5

6

7

8

9

10

C2s Directing Attacks by Country of Origin

Top 10 Countries Globally

1

2

3

4

8

5

7

6

9

10

Top 5 Bot Hosting Countries

Daily Average

1.8m

454k

248k

158k

147k

Compromised Hosts (Bots)

Top 10 Countries Globally

1

7

9

2

4

5

8

6

3

10

Top 5 Targeted Countries Based on Attack Command Volume

Hit with Bot Traffic Full Year 2017

1.

United States

2.

China

3.

Germany

4.

Russia

5.

United Kingdom

Top 5 Target Countries Based on Distribution of Attacks

Target Countries Full Year 2017

A Review of DDoS IoT Botnets

Gafgyt and Mirai

C2 Count by Family – for Activity Tracked in 2017:

Gafgyt

562 unique C2s tracked in 2017

minimum uptime - one day, maximum uptime - 117 days.

Mirai

339 unique C2s tracked in 2017

minimum uptime - one day, maximum uptime - 83 days.

Active Days C2:

Gafgyt

Mirai

Types and Volumes of Attack Commands Observed:

2nd Half 2017

Gafgyt

Mirai

Click here to find out how Mirai and Gafgyt work

How it works

Attack Commands Issued Total Per Month