Cybercrime Infrastructure Never Really Dies

guest · Jun 23, 2020

Cybercrime Infrastructure Never Really Dies
June 23, 2020
https://www.darkreading.com/attacks...frastructure-never-really-dies/d/d-id/1338154

Nine months after German police raided a Cold War-era bunker and shut down the group operating the cybercriminal service, command-and-control (C2) traffic and other network data continue to attempt to use the Internet address space assigned to the group, according to an analysis published by the SANS Technology Institute on Tuesday.

The analysis, part of a master's thesis, found that many telltale signs of the cybercrime operation continued to trickle in through the Internet.

The analysis shows that automate cybercriminal infrastructure will continue to produce traffic and could provide defenders with information on computers infected with botnet clients and other compromised hosts, says Karim Lalji, a managing security consultant at Canadian telecommunications firm TELUS and author of the report.
Click to expand...

"While this isn't anything new, it does astonish me how much activity is still going on almost nine months after the hosting facility was raided by law enforcement," Lalji says. "The servers were literally taken off the property and ripped apart by forensic analysts, yet there's still so much traffic."
The analysis yields interesting insight into the scale of operations of a well-known cybercriminal operation.

The CyberBunker operated in Germany is the second such facility raided by police. In 2013, the first CyberBunker — based in Amsterdam and operated by some of the same people — was shut down by police, following extended distributed denial-of-service attacks against anti-spam coalition SpamHaus.
The facility shut down in 2019, dubbed "CyberBunker 2.0" by the group operating the service, was based on three-acre property in the German town of Traben-Trarbach.
Click to expand...

Analysis: "Real-Time Honeypot Forensic Investigation on a German Organized Crime Network"
(PDF - 3.56 MB): https://www.sans.org/reading-room/whitepapers/threathunting/real-time-honeypot-forensic-investigation-german-organized-crime-network-39640

Log in or Sign up

Cybercrime Infrastructure Never Really Dies

guest Guest

Log in or Sign up

Cybercrime Infrastructure Never Really Dies

guest Guest

Useful Searches