Spamhaus Botnet Threat Update: Q1-2020

In the past quarter, the number of botnet Command & Controllers (C&Cs) associated with fraudulent sign-ups, reduced by 57%. Good news, we hope. However, a new malware has burst onto the scene and is making the most of one particular cloud operator’s infrastructure. Last but not least, it’s all changed (again) when it comes to the country that hosted more botnet C&Cs than any other.

Welcome to the Spamhaus Botnet Threat Update Q1 2020.

Spotlight: Raccoon Stealer

At the end of 2019, a newcomer joined the cyber threat landscape: Raccoon Stealer. This piece of malware is usually delivered to the end-user through spam campaigns, dropper, or exploit kits by malware that is already present on the victim’s machine.

Raccoon Stealer is a credential and information stealer that runs on MS Windows. However, it is also being used by threat actors to install additional malware. What makes Raccoon Stealer rather unique is where its botnet C&Cs are hosted: on the Google Cloud.

We discovered the first instance of Raccoon Stealer on November 19, 2019. Since then, we have identified several dozen new Raccoon Stealer C&Cs – all of them hosted on the Google Cloud. But why would a threat actor use Google to host their botnet infrastructure? To answer this question, let’s have a look at Spamhaus’ “World’s worst spam support ISPs”.

In Q1 2020, Spamhaus listed Google as the second-worst Internet Service Provider (ISP), in regards to spam support. The reason for this poor ranking is simple: Google takes a long time to handle abuse reports regarding spammer or phishing sites. In addition to this, it also takes a long time to handle abuse reports relating to botnet C&Cs hosted on their Cloud (Google Compute Engine).

At the time of publishing this update, many abuse reports remain unanswered. This provides a perfect environment for the bad actors abusing Google’s infrastructure to host malicious and harmful content, which is something the operator of Raccoon Stealer quickly noticed. Why bother looking for a shady and expensive bulletproof hosting provider when you can host your botnet infrastructure reliably and at minimal cost at Google?

Large Cloud operators can dramatically reduce the amount of badness on the internet by monitoring infrastructure for abuse, and where it’s reported taking rapid action to remediate. Earlier this year, we highlighted the efforts of Amazon Webs Services (AWS), who blocked port 25 outbound, resulting in a huge reduction of spam. Where a concerted effort is made, positive outcomes follow.

Number of botnet C&Cs observed, Q1 2020

The reason for this decrease is currently unproven. Having said that, we believe it could be partially related to a VPN provider who refuses to take action on abuse reports and is failing to shut down traffic from existing botnet C&Cs. If botnet C&Cs, which have been detected and reported, are allowed to continue to operate, there is no reason why miscreants should spin up new ones.

The drop in the number of newly registered botnet C&Cs we observed and blocked started to fall in December 2019, as the following chart indicates:

Geolocation of botnet C&Cs in Q1 2020

USA is back on top: In Q4 2019, Russia took the top spot from the United States (US). However, in Q1 2020, the US has returned to the #1 spot, accounting for approximately 35% of botnet C&C traffic.

Departures: Lithuania, Serbia, Cyprus, Greece and India.

New entries: Sweden (#13), Hong Kong (#14), Turkey (#17), Malaysia (#19) and Vietnam (#20).

Malware associated with botnet C&Cs, Q1 2020

Lokibot: In Q4 2019, Lokibot’s activity reduced; nonetheless, we saw a 33% increase in newly observed Lokibot C&Cs, from 403 in Q4 2019, to 535 in Q1 2020. Lokibot has held the #1 position on our Top Twenty list for over two years now!

AZORult: While we have seen a decrease in botnet activity associated with AZORult, it remained the second largest threat in Q1 2020.

NanoCore and Remcos: These two malware families appear to be fighting for dominance in the RAT market. While Remcos has never recorded more newly detected botnet C&Cs than NanoCore, the margin separating these two RATs is becoming smaller.

Most abused top-level domains, Q1 2020

.la: The most significant change in this Top Twenty list is the appearance of country code top-level domain (ccTLD) .la (Laos). Not only did .la make its way onto the chart, but it also entered at #2!

.com: Throughout 2019, we reported that the vast majority of botnet C&C domains were registered in the generic top-level-domain (gTLD) .com. This trend continued in Q1 2020 with .com accounting for approximately 45% of the top-level botnet C&C domains.

.pw & .xyz: These two TLDs have appeared in the Top Twenty for over a year, although there was a significant increase in the number of botnet C&C domain registrations associated with these TLDs in Q1 2020, placing them at #3 & #4 respectively.

Most abused domain registrars, Q1 2020

Key Systems: German based ‘Key Systems’ became the domain registrar with the second largest number of newly registered botnet C&C domains in Q1 2020.

Hosting Concepts: Last year, this Dutch domain registrar was responsible for a large number of botnet C&C domain registrations, particularly relating to bulletproof hosting. We are pleased to see that it appears Hosting Concepts is improving its registration processes, dropping from #3 in Q4 2020 to #7 in Q1 2020.

Internet Service Providers (ISPs) hosting botnet C&Cs, Q1 2020

Cloudflare: We continue to see cloudflare.com, a US-based content delivery network (CDN) provider, being one of the preferred options by cybercriminals to host botnet C&C servers. This trend has been evident since 2018.

In Q4 2019, Alibaba knocked Cloudflare off the #1 spot, but Cloudflare is back as the leader in Q1 2020, with more than 300 botnet C&Cs on their network. Disappointingly, we have still not seen any visible attempts from Cloudflare to battle the ongoing abuse on their network regarding botnet hosting and other hostile infrastructure.

You can download the 2020 Q1 Botnet Threat Report as PDF. We look forward to seeing you in July when we’ll be providing you with Quarter 2’s update.