Cyber conflicts are a reflection of traditional, “real life” human
conflicts. And the more serious the conflict in the “real world,” the
more conspicuous its cyber shadow is likely to be. So let’s look at a
serious, current international conflict – the one between Russia and
Ukraine – to see if we can find its reflection in cyberspace.
One of the most reliable ways to discover computer network operations
is to look for malware “callbacks” – the communications initiated from
compromised computers to an attacker’s first-stage command-and-control
(C2) server. At FireEye, we detect and analyze millions of such
callbacks every year.
Table 1, below, shows the top 20 countries to receive first-stage
malware callbacks over the last 16 months, according to the latest
FireEye data.
Table 1 – Callback Infrastructure: the Last 16 Months
As we track the evolution of callbacks during this period, we see a
likely correlation between the overall number of callbacks both to
Russia and to Ukraine, and the intensification of the crisis between
the two nations. The two key indicators we see are:
The biggest single monthly jump occurred in March 2014, when Russia
moved from #7 to #3. In that same month,
following events also took place in Russia and Ukraine:
The graphs below provide a closer look at the crucial month of March
2014, specifically comparing it to malware callback data from February.
Figure 1 shows a significant rise in malware callbacks to Russia from
three of the top four source countries in February: Canada, South
Korea, and the U.S. (Great Britain had a slight decline).
Figure 1 – Callbacks to Russia in Feb/Mar 2014: Top
Four Countries
Figure 2 depicts the same, general rise in callbacks to Russia from
many other countries around the world.
Figure 2 – Callbacks to Russia in Feb/Mar 2014: Rest
of World
Figure 3 shows that the sharp rise in callbacks to Russia in March
2014 was seen in every FireEye industry vertical.
Figure 3 – Callbacks to Russia in Feb/Mar 2014:
Industry Verticals
Tables 2 and 3, below, compare the rise in callbacks to Russia and
Ukraine against the rise in callbacks to other countries for February
and March 2014. It is
