Strategic Analysis: As Russia-Ukraine Conflict Continues, Malware
Activity RisesCyber conflicts are a reflection of traditional, “real life” human
conflicts. And the more serious the conflict in the “real world,” the
more conspicuous its cyber shadow is likely to be. So let’s look at a
serious, current international conflict – the one between Russia and
Ukraine – to see if we can find its reflection in cyberspace.
One of the most reliable ways to discover computer network operations
is to look for malware “callbacks” – the communications initiated from
compromised computers to an attacker’s first-stage command-and-control
(C2) server. At FireEye, we detect and analyze millions of such
callbacks every year.
Table 1, below, shows the top 20 countries to receive first-stage
malware callbacks over the last 16 months, according to the latest
FireEye data.
class="aligncenter wp-image-5519 landscape-med" alt="ru1"
src="/content/dam/legacy/blog/2014/05/ru1.jpg" width="738" height="293" />
Table 1 – Callback Infrastructure: the Last 16 Months
As we track the evolution of callbacks during this period, we see a
likely correlation between the overall number of callbacks both to
Russia and to Ukraine, and the intensification of the crisis between
the two nations. The two key indicators we see are:
- In 2013, Russia was, on average, #7 on this list; in 2014, its
average rank is #5.
- In 2013, Ukraine was, on average, #12 on this list; in 2014, its
average rank is #9.
The biggest single monthly jump occurred in March 2014, when Russia
moved from #7 to #3. In that same month, href="http://www.bbc.com/news/world-middle-east-26248275">the
following events also took place in Russia and Ukraine:
- Russia’s parliament authorized the use of military force in Ukraine;
- Vladimir Putin signed a bill incorporating the Crimean peninsula
into the Russian Federation;
- The U.S. and EU imposed travel bans and asset freezes on some
senior Russian officials;
- Russian military forces massed along the Ukrainian border; and
- Russian energy giant Gazprom threatened to cut off Ukraine’s
supply of gas.
The graphs below provide a closer look at the crucial month of March
2014, specifically comparing it to malware callback data from February.
Figure 1 shows a significant rise in malware callbacks to Russia from
three of the top four source countries in February: Canada, South
Korea, and the U.S. (Great Britain had a slight decline).
class="aligncenter wp-image-5520 landscape-sm" alt="ru2"
src="/content/dam/legacy/blog/2014/05/ru2.jpg" width="477" height="307" />
Figure 1 – Callbacks to Russia in Feb/Mar 2014: Top
Four Countries
Figure 2 depicts the same, general rise in callbacks to Russia from
many other countries around the world.
class="aligncenter wp-image-5521 landscape-sm" alt="ru3"
src="/content/dam/legacy/blog/2014/05/ru3.jpg" width="498" height="277" />
Figure 2 – Callbacks to Russia in Feb/Mar 2014: Rest
of World
Figure 3 shows that the sharp rise in callbacks to Russia in March
2014 was seen in every FireEye industry vertical.
class="aligncenter wp-image-5522 landscape-med" alt="ru4"
src="/content/dam/legacy/blog/2014/05/ru4.jpg" width="502" height="328" />
Figure 3 – Callbacks to Russia in Feb/Mar 2014:
Industry Verticals
Tables 2 and 3, below, compare the rise in callbacks to Russia and
Ukraine against the rise in callbacks to other countries for February
and March 2014. It is important to note that nearly half of the
world’s countries experienced a decrease in callbacks during
this same time frame.
Table 2 shows the countries that received the highest increase, from
February to March 2014, in the number of source countries sending
callbacks to them. Ukraine and Russia both placed in the top ten
countries worldwide, with Ukraine jumping from 29 source countries to
39, and Russia moving from 45 to 53.
class="aligncenter wp-image-5523 landscape-sm" alt="ru5"
src="/content/dam/legacy/blog/2014/05/ru5.jpg" width="338" height="248" />
Table 2 – Callbacks in 2014: Number of Source Countries
Table 3 shows the increase in the number of malware signatures
associated with the callbacks to each country for February and March
2014. Ukraine does not appear in the top ten (it tied for #15), but
Russia was #4 on this list (again, nearly half of the world’s
countries showed no increase or a decrease).
class=" wp-image-5524 aligncenter landscape-sm" alt="ru6"
src="/content/dam/legacy/blog/2014/05/ru6.jpg" width="328" height="229" />
Table 3 – Callbacks in 2014: Number of Malware Signatures
It is not my intention here to suggest that Russia and/or Ukraine are
the sole threat actors within this data set. I also do not want to
speculate too much on the precise motives of the attackers behind all
of these callbacks. Within such a large volume of malware activity,
there are likely to be lone hackers, “patriotic hackers,” cyber
criminals, Russian and Ukrainian government operations, and cyber
operations initiated by other nations.
What I want to convey in this blog is that generic, high-level href="http://en.wikipedia.org/wiki/Traffic_analysis">traffic
analysis – for which it is not always necessary to know the exact
content or the original source of individual communications – might be
used to draw a link between large-scale malware activity and important
geopolitical events. In other words, the rise in callbacks to Russia
and Ukraine (or to any other country or region of the world) during
high levels of geopolitical tension suggests strongly that computer
network operations are being used as one way to gain competitive
advantage in the conflict.
In the near future, we will apply this methodology to other global
occurrences to further identify patterns that could provide valuable
advanced threat protection insights.
Source:
Strategic Analysis: As Russia-Ukraine Conflict Continues, Malware
Activity Rises
