Regional Threat Perspectives, Fall 2019: Australia

F5 Labs, in conjunction with our partner Baffin Bay Networks, research global attack traffic region to region to gain a deeper understanding of the cyber threat landscape. Aside from attack campaigns targeting the entire Internet (IPv4 address space), the attack landscape varied regionally in terms of sources, targets, and attack types. In addition, targeted ports exposed regional differences in IT norms when it comes to the way non-standard ports are used for HTTP and SSH.

In this latest data collection, we looked at malicious traffic over the same 90-day period—August 1, 2019 through October 31, 2019—in the United States (U.S.), Canada, Australia, Europe, Russia, Asia, Latin America, and the Middle East. Australian systems were probed for vulnerabilities on the ports most commonly used by applications, but these attacks were outweighed by a global campaign targeting VNC port 5900.

• IP addresses assigned in Europe were the primary source of attacks targeting systems in Australia in the fall of 2019. Specifically, IP addresses assigned to OVH SAS in France launched the most malicious traffic to the region.
• The top five IP addresses launching attacks against systems in Australia were engaged in a global campaign targeting RFB/VNC port 5900 that began in June 2019. Because of this large global campaign, VNC port 5900 was the top targeted port in Australia during this period.
• The RFB/VNC port 5900 attacks brought a new threat actor network onto the scene: RM Engineering LLC out of Moldova.
• Attackers launched reconnaissance scans against Internet facing applications in Australia, looking for vulnerabilities in commonly used services (VNC, HTTP, HTTPS, SMB, RDP, MySQL). They also conducted credential stuffing attacks against SSH and Telnet remote access.

Top Source Traffic Countries

Before we look at the “top source traffic countries,” it’s important to clarify that we’re talking about the geographical source of IP addresses in this section. The “top source traffic” countries” does not mean that the country itself, individuals, or organizations based in that country were responsible for the malicious traffic. The attack traffic could be coming through a proxy server or compromised system or IoT device with IP addresses assigned in a particular country. For expediency, we refer to these as “top source traffic countries.”

IP addresses assigned to France launched the most malicious traffic against systems in Australia from August 1, 2019, through October 31, 2019. The top 10 source traffic countries during this period were:

1. France
2. Moldova
3. Russia
4. Italy
5. Netherlands
6. China
7. United States
8. South Korea
9. Turkey
10. Germany

All of the top 10, with the exception of Venezuela and Costa Rica, were also the top malicious source traffic countries globally. The top 5 source traffic countries, all within the European continent, is a threat profile only shared with Asia during this period. All other global regions had either the US, Canada or an Asian country in their top 5 source traffic countries list. 

IP addresses assigned in France launched the most attack traffic against systems in Australia, followed by IP addresses assigned in Moldova, Russia, Italy and the Netherlands. Traffic from IP addresses assigned in these five countries account for over a half (55%) of malicious traffic seen targeting Australian systems during this time period. IP addresses assigned in Russia (in third position) followed the traffic seen from Moldovan and French IP addresses. Much of this traffic was seen participating in RFB/VNC port 5900 port scanning and credential stuffing (seen all over the world).

Australia received attack traffic originating from two countries that were not seen attacking other regions of the world. These countries were Nigeria, in the 17^th position, and Australia itself in the 20^th position. Attacks sourced from these countries accounted for 2.2% of all malicious traffic directed towards Australia during this period. This is notable since in other regions of the world (including the US and Europe) in region malicious traffic tops the list and poses a bigger threat. This kind of traffic can be more difficult for enterprises to filter since typically businesses want everyone in their country to be able to access them. Even though in country traffic accounts for a relatively small portion of all malicious traffic, there were two Australian IP addresses appearing in the top 50 attacking IP addresses in position 36, and position 43. These two IP addresses account for 57.66% of all malicious traffic originating from Australian IP addresses.

Australia is one of three regions of the world where Singapore appears in the top 20 source traffic countries. IP addresses assigned in Singapore focused on Asia, Australia, and Canada. There were no IP addresses assigned in Singapore appearing in the top attacking IP list. Notably, though, although not in the top 20 source traffic countries, systems in Australia received over 32,000 attacks from one IP in Romania. No other IP addresses in Romania show up in the top attacking IP address list, discussed later. This indicates that attacks coming from IP addresses in Romania and Singapore (and probably many other countries!) were more distributed; that is, they were launched from lots of IP addresses with low numbers of attacks per address. This type of activity is deliberate and takes more resources (systems and manpower) to pull off, and therefore is typically attributed to more sophisticated threat actors intentionally disguising their activities.

Top Attacking Organizations (ASNs)

Systems in OVH SAS, a hosting provider offering dedicated servers and cloud solutions across datacenters all over the world, were the largest source of attack traffic targeting Australian systems this fall. All regions of the world received attacks from systems in OVH SAS during this time period, as well as previous periods (see F5 Labs Regional Threat Perspectives). OVH SAS is consistently a top network source of attack traffic globally. OVH SAS was also the top source network of attacks towards Russian and Canadian systems, the number two network source of attacks against systems in Europe and Asia, and number three network source of attacks against systems in the U.S. during this time period. Although OVH SAS offers hosting services from locations all over the world, 90% of the attack traffic towards Australian systems came from hosts with IP addresses in France, the other 10% from OVH SAS hosts in Canada. The global view of attacks launched from OVH SAS during this time period was similar in that 78% of the attacks originated from hosts with French IP addresses, followed by 20% with Canadian IP addresses, and 1% with IP addresses in the U.K.

The second largest network source of attacks against systems in Australia was RM Engineering LLC, through only seven IP addresses in Moldova. RM Engineering’s ASN 49877, however, is registered in Russia. All seven IP addresses launched RFB/VNC port 5900 attacks and attacked systems all over the world. Prior to the global attack campaign targeting VNC port 5900, which started in June of 2019, RM Engineering was not a top attacking network globally.

The ASN in third position, GTECH S.p.a. from Italy, launched attacks against Australia as well as systems all over the world. These attacks were multi-port scans, typical reconnaissance activity looking for vulnerabilities, and were broadly distributed across lots of IP addresses. Only two IP addresses from GTECH showed up in the top attacking IP addresses list across all regions, and they only accounted for 10% of the total attacks launched from their network towards Australian systems during this time period. The other 90% of attacks launched from the GTECH network were distributed across many IP addresses with smaller accounts of attacks per IP address, which is intentional behavior by threat actors attempting to fly under the radar.

The following table lists ASNs and their associated organizations (note that some ASNs have multiple ASNs).

ASNs Attacking Australia Compared to Other Regions

We looked at the count of attacks by ASN towards systems in Australia and compared that to other regions of the world. The key difference between attack traffic launched from networks targeting Australia versus the rest of the world was that the top networks targeting Australia launched significantly more attacks against systems in the U.S., Canada, Europe, Middle East and Asia. Six ASNs exclusively targeted systems in Australia (see ASNs denoted with *** in Figure 4). These include ASNs located in China (China Mobile, China Unicom and Beijing Baidu Netcom Science and Technology Co), Switzerland (Fink Telecom), Sweden (Elite Services, 31173), and the U.S. (Interserver).

Top Attacking IP Addresses

The top ten IP addresses attacking systems in Australia from August 1, 2019 through October 31, 2019 were all engaged in abusive port scanning followed by RFB/VNC port 5900 credential stuffing attacks. These attacks can from IP addresses in the networks of OVH SAS (France), RM Engineering (Moldova), Hostkey B.v. (Russia), and Serverius Holding B.v (Netherlands). Forty-eight percent of the IP addresses on the top 50 attacking IP addresses list were engaging in the same RFB/VNC port 5900 scanning and credential stuffing attacks.¹ These port 5900 attacks were new activity we noticed earlier in the summer and continued through October 31, 2019. We have opened up a public threat hunting investigation on Twitter to uncover what is going on with these attacks and will be looking to share our findings and ask questions soon. For now, join the conversation on Twitter.

For a complete list of attacks by IP address, see section Attacks Types of Top Attacking IP Addresses below.

IP Addresses Attacking Australia Compared to Other Regions

We compared the volume of attack traffic systems in Australia received per IP address to other regions of the world. The top 10 source IP addresses of attacks against Australian systems where the most overlap occurs (see Figure 6) were engaged in global attacks against RFB/VNC port 5900 (see the next section). Twenty-eight percent of the top attacking IP addresses sending malicious traffic to Australia were exclusively targeting the Australian region (see IP addresses denoted with *** in Figure 6).

Attacks Types of Top Attacking IP Addresses

Outside of the global RFB/VNC port 5900 attacks (48% of top 50 IP addresses), a lot of general reconnaissance and vulnerability probing occurred against systems in Australia in the fall of 2019. Forty-two percent of the top 50 IP addresses on the top attacking list launch generic reconnaissance scans looking for vulnerabilities by probing multiple, if not all 65,000 ports. These IP addresses were from all over the world (10 countries), inside 13 different ASNs. Eight IP addresses were engaged in targeting SSH port 22 with credential stuffing attacks, behavior that’s typical of IoT bot building or targeting vendor default SSH credentials. The remaining IP addresses were scanning for systems with the Microsoft RDP port 3389 open, HTTP port 80 and HTTPS port 443, MySQL port 3306 and SMTP email port 25. When scanning for SMTP email port 25, we also saw credential stuffing on POP3 port 110, and spamming from port 25.

The following table is in descending order starting with top attacking IP addresses and includes the attack types each IP address launched.

Top Targeted Ports

It’s not surprising that RFB/VNC port 5900, what was attacked all over the world during this time period, was the number one attacked port in Australia by a large margin. This activity is not typical, hence the investigative threat hunting we are doing on Twitter mentioned previously.

In a distant second was SSH port 22, followed by HTTP ports 80 and 443, and Telnet port 23 rounding out the top 5 attacked ports. Given the port probing and credential stuffing attacks seen, it is clear attackers were targeting applications (over VNC, HTTP, HTTPS, SMB, RDP), remote administration of applications over SSH and Telnet, and email over SMTP in Australia.

One port was uniquely targeted in Australia during this time period: port 47720.

Conclusion

In general, the best approach a security team can take as defenders in this modern threat landscape is one of “assume breach.” This is not a FUD (fear, uncertainty, and doubt) position, this is a realistic position backed up by the volume of attack traffic all systems touching the Internet receive, the likelihood of vulnerabilities existing, and the amount of compromised credentials available to attackers. When you take an “assume breach” defensive position, you are collecting attack traffic and monitoring your logs. You can use this high-level attack data to compare against the attack traffic directly hitting your own network. This will help you rule out run-of-the-mill attack traffic, or help you determine whether or not you are being targeted, in which case, investigating the attack sources and patterns is a worthwhile activity.

Additionally, you should lock down as soon as possible any of the top targeted ports that do not absolutely require unfettered Internet access. And because default vendor credentials are commonly left in place, and the volume of breached credentials in 2017 was so large that many usernames and passwords are now considered “public,” all organizations should have credential stuffing protection in place. Particularly for any system with remote authentication, and especially administrative remote access. See F5 Labs report Lessons Learned from a Decade of Data Breaches for more data on these breached passwords.

Security Controls

To mitigate the types of attacks discussed here, we recommend the following security controls be put in place: