Akamai shared a detailed analysis of a Fast Flux Botnet composed of 14K IPs

Experts at Akamai have identified a running Fast Flux botnet composed of over 14,000 compromised systems used to spread malware.

Experts at Akamai have identified a running botnet of over 14,000 compromised systems used to spread malware. The botmasters implemented a technique dubbed Fast Flux to make the infrastructure hard to take down.

Treat actors implementing the Fast Flux technique hosts a domain using multiple IP addresses by switching the domain from one IP to another. The IP addresses are swapped in and out with extremely high frequency, through changing DNS records.

The Fast Flux technique was first implemented in 2016 by the Storm Worm malware variants.

“Fast Flux, a DNS technique first introduced in 2006 and widely associated with the Storm Worm malware variants, can be used by botnets to hide various types of malicious activities – including phishing, web proxying, malware delivery, and malware communication.” reported Akamai. “The technique allows the botnet to “hide” behind an ever-changing network of compromised hosts, ultimately acting as proxies and making detection incredibly difficult.”

Experts were able to track a botnet composed of more than 14,000 IP addresses, most of them originating from eastern Europe.

The Fast Flux Network works as an illegal websites hosting provider for illegal websites
offering merchandise such as:

• Stolen credentials for popular e-commerce websites
• Hacked credit card numbers with CVV
• Professionals hackers carders forum

The botnet was working for both hosting phishing websites and malware C&C servers, it was also utilized for carrying out automated attacks such as web scraping, SQL injections, and credentials abuse.

“The primary characteristic of the Fast Flux network is that the network constantly changes its domains, IP addresses, and nameservers. These changes obfuscate the true nature of the network and make it more difficult for researchers to understand and defend against.” continues the analysis.

Researchers observed the Fast Flux network is being segregated to different sub-networks based on the offered malicious service

Researchers believe devices were infected with malware that installs a proxy component on the infcted hosts. Every time someone wants to connect to a malicious site exposed by the botnet, DNS servers would provide the IP of an infected host that was at that time “hosting” the domain. The proxy component of the infected host then redirects incoming traffic to the malicious site, hosted elsewhere.

The analysis of the Botnet revealed it was organized in two separate sub-networks:

• the hosting sub-network used for hosting and redirecting traffic to malicious sites.
• the C&C sub-network composed of the command-and-control infrastructure of the botnet, that is different from the C&C servers.

Experts noticed that most of the hosting sub-network were located in Ukraine, Romania, and Russia. The composition of the botnet’s C&C sub-network was very different.

The botnet’s C&C sub-network IPs contained private IP addresses, such as 10.x.x.x, 192.168.x.x, belonging to Fortune 100 companies, as well as military organizations.

The analysis of the exposed ports for all IPs shows that most of the hosting network had ports 80 and 443 exposed, while most of the C&C sub-network had port 7547 exposed.

The port 7547 is specific to the TR-069 protocol implemented by remote management tools of routers and modems, these devices are suspected to represent a good portion of the botnet.

According to Akamai, Fast Flux botnets can be compared to a living organism that evolves over the time to preserve itself, experts will continue to monitor its evolution.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Fast Flux botnet, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]