Regional Threat Perspectives, Fall 2019: Russia

Introduction

F5 Labs, in conjunction with our partner Baffin Bay Networks, research global attack traffic region to region to gain a deeper understanding of the cyber threat landscape. Aside from attack campaigns targeting the entire Internet (IPv4 address space), the attack landscape varies regionally in terms of sources, targets, and attack types. In addition, targeted ports expose regional differences in IT norms when it comes to the way non-standard ports are used for HTTP and SSH.

In this latest data collection, we looked at malicious traffic over the same 90-day period—August 1, 2019 through October 31, 2019—in the United States (U.S.), Canada, Latin America, Europe, Russia, Middle East, Asia, and Australia. We separated Russia from Europe because Russia is consistently a top source traffic country globally, so we wanted to understand if its threat landscape was different—and it was. Attacks targeting Russian systems originated from more unique source networks and IP addresses than anywhere else in the world.

• IP addresses assigned in the U.S. launched the most malicious traffic towards systems in Russia from August 1, 2019, through October 31, 2019. The U.S. is a top source traffic country globally, however, 90% of the IP addresses in the U.S. that attacked Russian systems in the fall of 2019 were not seen attacking other regions.
• Russian IP addresses were responsible for 13% of the attacks received by Russia systems during the fall of 2019.
• Fifty-eight (58%) percent of the IP addresses seen sending malicious traffic to Russia exclusively targeted Russian systems.
• The top ports targeted in Russia followed similar patterns to the rest of the world with SMB port 445 being the #1 attacked port and SSH port 22 being the #3 top attacked port.
• The Swiss Exchange service port 7326 was the #2 attacked port in Russia, which is very interesting given the potential financial implications, and the fact that this was not a top attacked port anywhere else in the world in this time period.
• Outside of multi-port reconnaissance scanning looking for commonly used web application ports, attackers are conducting credential stuffing attacks on RFB/VNC port 5900, SSH port 22, and Telnet port 23 (common with IoT bot building).

Top Source Traffic Countries

Before we look at the top “source traffic countries,” it’s important to clarify that we’re talking about the geographical source of IP addresses in this section. The “top source traffic countries” does not mean that the country itself, individuals, or organizations based in that country were responsible for the malicious traffic. The attack traffic could have been coming through a proxy server or compromised system or IoT device with IP addresses assigned in a particular country. For expediency, we refer to these as “top source traffic countries.”

IP addresses assigned in the U.S. launched the most malicious traffic towards systems in Russia from August 1, 2019, through October 31, 2019. The U.S. is a top source traffic country globally, however 90% of the IP addresses in the U.S. that were attacking Russian systems in the fall of 2019 were not seen attacking other regions. Whereas the U.S. being a top source country is not unique, the attacks sourced from IP addresses in the U.S. to Russia were exclusively targeting systems in Russia. Conversely, 70% of the IP addresses in the Netherlands (which is a top source traffic country globally) that attacked systems in Russia were also engaged in global attack campaigns; Russian systems weren’t the only target.

The number of attacks launched from IP addresses in Russia regularly drive Russia into one of the top three source traffic country positions globally. This is no exception for Russia itself as 13% of the attacks received by Russia systems during the fall of 2019 came from IP addresses in Russia. This kind of traffic can be more difficult for enterprises to filter as they can’t simply block IP addresses by geography since businesses typically want to remain accessible to customers in their region.

All of the top 10 source traffic countries of attacks targeting Russian systems in the fall of 2019 were top source traffic countries globally.

Note: The “normalized” attack count is not the total attack count collected, it is a calculated number considering the number of attack collection sensors region to region. We use normalized attack data in these reports in order to accurately compare attack data between regions and ensure that no single region is overrepresented in the total data analysis.

Sixty percent (60%) of the attacks launched towards Russian systems came from the top 5 source traffic countries. In addition to the U.S., Netherlands, and Russia in the top 3 positions, attacks launched from IP addresses in Germany (in position 4) were uniquely scanning for port 7326. Port 7326 is used by the Swiss Exchange (SWX) and Internet Citizen’s Band (ICB) services. No other region was targeted on that port, or by the German IP addresses launching the attacks. Additionally, attacking IP addresses that drove Italy into position 5 on the top source countries list engaged in SWX/ICB scanning, unique to Russia.

Top Attacking Organizations (ASNs)

Attacks targeting Russian systems came from more unique ASNs than in any other region. Attacks from 36% percent of the ASNs on the top 50 attacking ASNs list were uniquely destined for Russian systems. These networks, listed below, accounted for 28% of total attack traffic Russian systems received in the fall of 2019.

Four of the networks: 1&1 Versatel Deutschland GmbH, Hostmaze Inc Srl-d, ITC NG ltd and Tellcom Iletisim Hizmetleri A.s., did not have IP addresses on the top 50 attacking IP addresses list, indicating attacks from these networks were diversified across many IP addresses.

Attacks from the OVH SAS network, primarily sourced from France and also Canada, drove OVH SAS to the number 1 position in the top attacking networks list. The OVH SAS network was within the top 5 attacking networks in all regions of the world during this timeframe, with the exception of attacks destined for the Middle East. OVH SAS is a top attacking network globally on a regular basis. The attacks from IP addresses in this network in the fall of 2019 were RFB/VNC credential stuffing attacks targeting systems all over the world and were not unique to Russia.

The Hetzner Online Gmbh network assigned in Germany had a similar attack profile as OVH SAS. This network engaged in global attacks targeting all regions of the world, including Russia.

Attacks coming from Softlayer Technologies networks in the U.S. and Netherlands were also felt all over the world during this period. However, the only IP addresses in this network that showed up on the top 50 attacking IP addresses list were attacks toward Russia. That means attacks generated from Softlayer during this period destined for other regions of the world were conducted at lower counts per IP address, so they didn’t show up on a top attacking IP addresses list. Rounding out the top 5 network sources of attacks against Russia in the fall of 2019 were GTECH and Korea Telecom. Attacks from both of these networks were launched globally and were not unique to Russia.

The following table lists ASNs and their associated organizations (note that some ASNs have multiple ASNs).

ASNs Attacking Russia Compared to Other Regions

We looked at the count of attacks by ASN launching attacks toward systems in Russia and compared that to other regions of the world. The key difference between attack traffic launched from networks targeting Russia versus the rest of the world was the volume of attack traffic launched from the 18 ASNs exclusively targeting systems in Russia (see ASNs denoted with *** in Figure 4). Sixty-four percent (64%) of the total attack volume in Russia came from networks uniquely targeting Russia. Additionally, the exponential increase in attacks systems in the Middle East received from networks that also targeted Russian systems is notable.

Top 50 Attacking IP Addresses

Two of the top three IP addresses attacking Russian systems in the fall of 2019 were not seen targeting systems anywhere else in the world. The following table shows all 29 IP addresses (or 58% of the 50 IP addresses targeting Russian systems list) that were not seen attacking systems in other regions of the world during the fall of 2019. There are more IP addresses on this list from the U.S. than anywhere else in the world. Comparatively, when looking at all top 50 IP addresses attacking all regions of the world, there are more Russian IP addresses than any other country. All of these IP addresses engaged in port scanning, 34% of which specifically targeted the Swiss Exchange service.

Similar to the U.S., IP addresses assigned within the country were uniquely targeting systems in Russia versus launching global attacks. 63% of the Russian-assigned IP addresses attacking systems inside Russia were uniquely targeting Russian systems. The other 37% were all from one network, Hostkey B.V, which participated in a global attack campaign targeting RFB/VNC port 5900 with credential stuffing attacks.¹

For a complete list of attacks by IP address, see section Attacks Types of Top Attacking IP Addresses below.

IP Addresses Attacking Russia Compared to Other Regions

We compared the volume of attack traffic systems in Russia received per IP address to other regions of the world and there was a clear difference. As mentioned in the previous section, 54% of the IP addresses on Russia’s top 50 attacking IP addresses list (see IP addresses denoted with *** in Figure 6) exclusively targeted Russian systems, a pattern that stands out visually when comparing the attack counts Russia received to attacks received by the rest of the world.

Attacks Types of Top Attacking IP Addresses

Fifty-eight (58%) percent of the IP addresses seen sending malicious traffic to Russia exclusively targeted this region in the fall of 2019. Expectedly, abusive port scanning looking for vulnerabilities occured with each IP address. Outside of multi-port reconnaissance scanning, attackers were looking for the following open services on Russian systems:

• RFB/VNC port 5900
• Microsoft SMB port 445
• Swiss Exchange service port 7326
• HTTP/S ports 80, 443, 8080
• SSH port 22, 2222
• Telnet port 23
• SMTP port 25
• MS SQL port 1433

After scanning for these open services, attackers conducted credential stuffing attacks on RFB/VNC port 5900, SSH port 22, and Telnet port 23 (common with IoT bot building). The port 5900 attacks were new activity we noticed earlier in the summer, and they continued through October 31, 2019. We have opened up a public threat hunting investigation on Twitter to uncover what is going on with these attacks and will be looking to share our findings and ask questions soon. Join the conversation on Twitter.

The following table is in descending order of attack count, starting with top attacking IP addresses; it includes the attack types each IP address launched.

Top Targeted Ports

SMB port 445 was the number one attacked port in Russia (consistent with global attack activity since the Eternal Blue exploit was released in April 2017). In a close second was the Swiss Exchange port 7326, which is very interesting, given the potential financial implications and the fact that this was not a top attacked port anywhere else in the world during this time period. (Other ports attacked on Russia systems during this time period that were not attacked in other regions include Signet CTF port 2733 and port 21455.)

SSH port 22 in the third position was another top attacked port globally because vendor default credentials used to remotely administer applications over SSH are known to attackers. For a list of top attacked SSH credentials, see this F5 Labs article about the top attacked credentials. SMB port 445 and SSH port 22 are commonly targeted because exploiting a vulnerability on either port (especially SMB port 445 when using the Eternal Blue exploit) can give a malicious actor access to the entire system.

RFB / VNC port 5900 scanning and credential stuffing, which were conducted against systems all over the world, is not typical, hence the investigative threat hunting we are doing on Twitter. The remaining top targeted ports—all web application, access, and email ports—clearly indicate attackers went after applications and access to applications in Russia (as they did all across the world).

Conclusion

In general, the best approach a security team can take as defenders in this modern threat landscape is one of “assume breach.” This is not a FUD (fear, uncertainty, and doubt) position, this is a realistic position backed up by the volume of attack traffic all systems touching the Internet receive, the likelihood of vulnerabilities existing, and the number of compromised credentials available to attackers. When you take an “assume breach” defensive position, you are collecting attack traffic and monitoring your logs. You can use this high-level attack data to compare against the attack traffic directly hitting your own network. This will help you rule out run-of-the-mill attack traffic, or help you determine whether or not you are being targeted, in which case, investigating the attack sources and patterns is a worthwhile activity.

Locking down any of the top targeted ports that do not absolutely require unfettered Internet access should be completed as soon as possible. And because default vendor credentials are known by attackers, all systems should be hardened before being deployed and protected with multi-factor authentication.

Additionally, the volume of breached credentials in 2017 was so large that usernames and passwords should be considered “public,” therefore all organizations should have credential stuffing protection in place. Particularly for any system with remote authentication. See F5 Labs report Lessons Learned from a Decade of Data Breaches for more data on these breached passwords.

Security Controls

To mitigate the types of attacks discussed here, we recommend the following security controls be put in place: