KashmirBlack Botnet Uses DevOps to Stay Agile

guest · Oct 22, 2020

KashmirBlack Botnet Uses DevOps to Stay Agile
October 22, 2020
https://www.infosecurity-magazine.com/news/kashmirblack-botnet-uses-devops-to/

Security researchers have lifted the lid on a highly sophisticated global botnet operation performing millions of attacks per day, including cryptocurrency mining, spamming and defacements.

Dubbed “KashmirBlack” by a team at Imperva, hundreds of thousands of compromised machines are controlled by a single command and control (C&C) server.
The botnet’s infrastructure is apparently more sophisticated than most, using DevOps techniques to drive agility and ensure new payloads and exploits can be added fairly easily.

This agility also means the botnet can rapidly change the repositories such as GitHub where it stores malicious code, as well as its C&C infrastructure, which Imperva claimed recently migrated to Dropbox to hide its tracks.
Click to expand...

In a sign of how alert the botherders are to potential outside disruption, Imperva claimed that they blocked access to its honeypot servers in just three days after growing suspicious.

Indonesian web defacement cybercrime group PhantomGhost has been linked to the botnet, the security vendor claimed.

“This is the first time we have been able to get visibility into how exactly a botnet like this operates; an important discovery that will help the industry better understand how these nefarious groups evolve and sustain their activity,” said Ofir Shaty, Imperva security researcher and research co-author.
“The level of orchestration is remarkable. It’s a very polished operation using the latest software development techniques. [...]”
Click to expand...

Imperva: CrimeOps of the KashmirBlack Botnet – Part I

This blog will give you a taste of the CrimeOps (criminal operations) behind one of these attacks – the KashmirBlack botnet.
Abstract
In the following sections we’ll describe the DevOps behind the KashmirBlack botnet, discuss the purpose of the botnet, and the journey we took during our research.

The KashmirBlack botnet mainly infects popular CMS platforms. It utilizes dozens of known vulnerabilities on its victims’ servers, performing millions of attacks per day on average, on thousands of victims in more than 30 different countries around the world.
Click to expand...

guest · Oct 22, 2020

Imperva: CrimeOps of the KashmirBlack Botnet – Part II

The previous blog – “CrimeOps of the KasmirBlack Botnet – Part I” – described the DevOps behind the botnet. It showed how its well-designed infrastructure makes it easy to expand and add new exploits or payloads without much effort,and explained the evolution and version deployment of the botnet.

Three questions were raised: What? When? And How? – although only the first two were answered.
This blog will uncover the bits-and-bytes behind the third question: How?
We will explain how the KashmirBlack botnet operates, describe its entities, and dive into the spreading technique.
Click to expand...

Log in or Sign up

KashmirBlack Botnet Uses DevOps to Stay Agile

guest Guest

guest Guest

Log in or Sign up

KashmirBlack Botnet Uses DevOps to Stay Agile

guest Guest

guest Guest

Useful Searches