Support Contact us

  • Categories

  • Tags

    Antivirus ATT&CK Awards AZORult Business Partners CISO Collaboration Community Covid19 Credentials CrydBrox Cyber Attacks cybercrime Cyber resilience Cyber Security Cyber Threats Darknet Markets Dark web Data Breach digital risk Financial & Banking Fraud Hacktivism incident response industry Insurance Iran Malware MSSP Partners Ransomware Real-time research SOC startup Stealer Threat Actors Threat Analysis Threat Context Threat Detection Tools Threat Intel Feeds Threat Intel Guide Threat Intelligence Threat Intel Tools Vulnerability

    • on

    October 27, 2014

    Measuring the impact of Shellshock in the threat intelligence landscape

    Once high profile vulnerability is released to the public, there are a lot of people who will use the opportunity to take advantage on vulnerable machines, even if it is manually or widely exploited using pieces of malware. A clear example is the evolution of Mayhem to take advantage of Shellshock proving how quickly criminals can mobilize when they use existing malware infrastructure.

    In this post, I don’t pretend to extend the information that is already at the Internet nowadays about Shellshock and how it has been exploited in the wild. For this reason, one month after the Bash related vulnerabilities were published, we have tried to analyze the impact of this disclosure in the threat intelligence landscape by analyzing how many new remote backdoors, exploit kits and C&C servers are being found by Blueliv’s CrimeTracker.

    Blueliv crimetracker

    Figure 1. Blueliv’s CrimeTracker

    After analyzing the information with the analytics engine, we’ve found the following amount of new C&C detections by month, noticing that in September and October we detected an increase of around 40-45% new Control Panel.

    C&C detections by month in Blueliv tracker

    Figure 2. C&C detections by month in Blueliv’s CrimeTracker

    If we go deeper into September and October in order to analyze the detection by week, we can see that 2 weeks after the Shellshock incident our C&C detection ratio has increased by almost the same ratio (~40 %):

    C&C detections by week in Blueliv crimetracker

    Figure 3. C&C detections by week (Sept – Oct 2014) in Blueliv’s CrimeTracker

    It is quite interesting the fact that 1-2 weeks after the vulnerability disclosure more C&C panels have appeared in the wild. The question is: Why 1-2 weeks after?

    Someone could answer that in theory the modus operandi could have been:
    1. Identify and massively hack vulnerable servers
    2. Trojanize or backdoor the compromised servers
    3. Sell remote access to fraudsters
    4. Place new C&C

    In conclusion, with this quick review with our analytics engine we’ve seen how quickly criminals can mobilize when vulnerability is released to the public (also with no so public vulnerabilities), they use existing malware infrastructure.

    Ramon Vicens
    Labs Manager

    Demo Free Trial MSSP
    Program