Strategic Analysis: As Russia-Ukraine Conflict Continues, Malware
Activity Rises[html]
Cyber conflicts are a reflection of traditional, “real life” human
conflicts. And the more serious the conflict in the “real world,” the
more conspicuous its cyber shadow is likely to be. So let’s look at a
serious, current international conflict – the one between Russia and
Ukraine – to see if we can find its reflection in cyberspace.
One of the most reliable ways to discover computer network operations
is to look for malware “callbacks” – the communications initiated from
compromised computers to an attacker’s first-stage command-and-control
(C2) server. At FireEye, we detect and analyze millions of such
callbacks every year.
Table 1, below, shows the top 20 countries to receive first-stage
malware callbacks over the last 16 months, according to the latest
FireEye data.
class="aligncenter wp-image-5519 landscape-med" alt="ru1"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/05/ru1.jpg"
width="738" height="293" />
Table 1 – Callback Infrastructure: the Last 16 Months
As we track the evolution of callbacks during this period, we see a
likely correlation between the overall number of callbacks both to
Russia and to Ukraine, and the intensification of the crisis between
the two nations. The two key indicators we see are:
- In 2013, Russia was, on average, #7 on this list; in 2014, its
average rank is #5.
- In 2013, Ukraine was, on average, #12 on this list; in 2014, its
average rank is #9.
The biggest single monthly jump occurred in March 2014, when Russia
moved from #7 to #3. In that same month, href="http://www.bbc.com/news/world-middle-east-26248275">the
following events also took place in Russia and Ukraine:
- Russia’s parliament authorized the use of military force in Ukraine;
- Vladimir Putin signed a bill incorporating the Crimean peninsula
into the Russian Federation;
- The U.S. and EU imposed travel bans and asset freezes on some
senior Russian officials;
- Russian military forces massed along the Ukrainian border; and
- Russian energy giant Gazprom threatened to cut off Ukraine’s
supply of gas.
The graphs below provide a closer look at the crucial month of March
2014, specifically comparing it to malware callback data from February.
Figure 1 shows a significant rise in malware callbacks to Russia from
three of the top four source countries in February: Canada, South
Korea, and the U.S. (Great Britain had a slight decline).
class="aligncenter wp-image-5520 landscape-sm" alt="ru2"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/05/ru2.jpg"
width="477" height="307" />
Figure 1 – Callbacks to Russia in Feb/Mar 2014: Top
Four Countries
Figure 2 depicts the same, general rise in callbacks to Russia from
many other countries around the world.
class="aligncenter wp-image-5521 landscape-sm" alt="ru3"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/05/ru3.jpg"
width="498" height="277" />
Figure 2 – Callbacks to Russia in Feb/Mar 2014: Rest
of World
Figure 3 shows that the sharp rise in callbacks to Russia in March
2014 was seen in every FireEye industry vertical.
class="aligncenter wp-image-5522 landscape-med" alt="ru4"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/05/ru4.jpg"
width="502" height="328" />
Figure 3 – Callbacks to Russia in Feb/Mar 2014:
Industry Verticals
Tables 2 and 3, below, compare the rise in callbacks to Russia and
Ukraine against the rise in callbacks to other countries for February
and March 2014. It is
