Regional Threat Perspectives, Fall 2019: Asia

F5 Labs, in conjunction with our partner Baffin Bay Networks, researches global attack traffic region to region to gain a deeper understanding of the cyber threat landscape. Aside from attack campaigns targeting the entire Internet (IPv4 address space), the attack landscape varies regionally in terms of sources, targets, and attack types. In addition, targeted ports expose regional differences in IT norms when it comes to the way non-standard ports are used for HTTP and SSH.

In this latest data collection, we looked at malicious traffic over the same 90-day period—August 1, 2019 through October 31, 2019—in the United States (U.S.), Canada, Latin America, Europe, Russia, the Middle East, Asia (excluding China), and Australia. The attack landscape targeting systems in Asia during the fall of 2019 was largely driven by global attack campaigns scanning for vulnerable applications and conducting credential stuffing attacks.

• A network in Italy, owned by global gambling company GTECH, launched enough attacks against systems in Asia to make Italy the number one geographical source of attack traffic towards Asia.
• Credential stuffing attacks targeting RFB/VNC port 5900 launched through networks in Russia, France, and Moldova were not unique to systems in Asia; these attacks were felt all over the world.
• Fifty percent of the countries in the top attacking source countries list are inside southeast Asia and combined, accounted for 39% of the region’s attack traffic in the fall of 2019.
• RM Engineering, with IP addresses registered in Moldova and having an ASN number (49877) registered in Russia, accounted for 99% of the total attack traffic launched from Moldavian IP addresses towards systems in Asia.
• Only three IP addresses on the top 50 attacking list were from inside Asia. However, Asian countries appear on the top attacking countries list, and Asian networks appear on the top attacking networks list. This indicates that attacks originating from Asian IP addresses were distributed across many IP addresses at a lower attack counts per IP address. This is behavior typically associated with more sophisticated threat actors attempting to fly under the radar.
• The top targeted port, SMB port 445, and the third most attacked port, SSH port 22, were commonly targeted across the world because exploiting a vulnerability on either of these services can give a malicious actor access to the entire system.

Top Source Traffic Countries

Before we look at the top “source traffic countries,” it’s important to clarify that we’re talking about the geographical source of IP addresses in this section. The “top source traffic countries” does not mean that the country itself, individuals, or organizations based in that country were responsible for the malicious traffic. The attack traffic could be coming through a proxy server or compromised system or IoT device with IP addresses assigned in a particular country. For expediency, we refer to these as “top source traffic countries.”

IP addresses assigned in Italy launched the most malicious traffic against systems in Asia from August 1, 2019, through October 31, 2019. Most of this traffic (90%) came from one network in Italy: GTECH S.p.A., a global gambling company that was seen attacking all regions of the world during this time period. These attacks were distributed across many IP addresses; only 10% of the total attack traffic from this Italian network towards systems in Asia were generated from IP addresses on the top 50 attacking IP addresses list. This distributed style of attack is deliberate and takes more resources (systems and manpower) to pull off, and therefore is typically attributed to more sophisticated threat actors.

The top 10 countries of source traffic targeting Italian systems in the fall of 2019 were:

1. Italy
2. Russia
3. France
4. Moldova
5. Netherlands
6. China
7. U.S.
8. South Korea
9. India
10. Vietnam

With the exception of India, all of the top ten source traffic countries were seen attacking all regions of the world. The top 5 source traffic countries, all within the European continent, was a threat profile only shared with Australia during this period.

Similar to the European and Latin American threat landscapes, systems in Asia received a considerable amount of attacks coming from in-region systems. Fifty percent of the countries in the top attacking source countries list are inside southeast Asia and combined, accounted for 39% of the region’s attack traffic. Asia was the only region of the world that received attacks from IP addresses in Thailand during this time period. This type of behavior can be more difficult for enterprises to filter out as it requires behavioral detection versus geographical IP address blocking, assuming that businesses want to remain accessible to customers within their region.

The IP addresses in Russia, France, and Moldova all launched Remote Frame Buffer (RFB) / Virtual Network Computing (VNC) port 5900 credential stuffing attacks against systems all over the world. The Netherlands IP addresses (in fifth position), all launched different types of attacks directed at a smaller global footprint that targeted only a few global regions at a time.

Note: The “normalized” attack count is not the total attack count collected, it is a calculated number considering the number of attack collection sensors region to region. We use normalized attack data in these reports in order to accurately compare attack data between regions and ensure that no single region is overrepresented in the total data analysis.

Top Attacking Organizations (ASNs)

RM Engineering, with IP addresses registering in Moldova but having ASN number (49877) registered in Russia, accounted for 99% of the total attack traffic launched from Moldavian IP addresses towards systems in Asia. OVH SAS registered in France accounted for 89% of the attacks launched from French IP addresses towards systems in Asia during the same period. The attacks coming from these networks targeted RFB port 5900 with credential stuffing attacks and were received by systems all over the world. RM Engineering is new to our top threat actor network tracking as of June 2019, when the global campaign targeting RFB began, unlike OVH SAS which has routinely shown up on top attacking network lists in our Hunt for IoT Report series for years. GTECH, the network in third position that is driving Italy into the top position on the geographic source country list, was new to the top threat actor networks list globally. As stated previously, the attacks coming from this network were distributed with a small number of attacks being launched from many IP addresses. The attacks are abusive port scanning, typically associated with network reconnaissance looking for vulnerabilities.

The following table lists ASNs and their associated organizations (note that some ASNs have multiple ASNs).

ASNs Attacking Asia Compared to Other Regions

We looked at the count of attacks by ASN towards systems in Asia and compared that to other regions of the world. The key difference between attack traffic launched from networks targeting Asia versus the rest of the world was the 7 ASNs, 6 of which are inside Asia, that exclusively targeted systems in Asia (see ASNs denoted with *** in Figure 4). Additionally, many networks targeting systems in Asia were clearly launching exponentially more attacks against systems in the Middle East.

IP Addresses Attacking Asia Compared to Other Regions

We compared the volume of attack traffic systems in Asia received per IP address to other regions of the world. With 16% of IP addresses uniquely targeting systems in Asia (see IP addresses denoted with *** in Figure 6), attack traffic destined for these systems had considerable overlap with the rest of the world. A clear differentiator is the number of attacks systems in the U.S. received from the same IP addresses targeting systems in Asia.

IP Addresses Attacking Europe Compared to Other Regions

The following chart shows the volume of attack traffic European systems received per IP address in comparison to other regions of the world. Attack traffic destined for European systems had some overlap with the rest of the world, with many IP addresses seen in Europe also seen in 6 or 7 other regions of the world. There is an exception of a handful of IP addresses launching global attacks against RFB/VNC port 5900 (see the next section). Although geographically in the same region, the European and the Russian threat landscapes saw little overlap in terms of specific IP addresses sending malicious traffic. Eighteen percent of the top attacking IP addresses sending malicious traffic to Europe were unique to Europe, while 16% of that top 50 were seen sending malicious attack traffic to all other regions in the world.

Attacks Types of Top Attacking IP Addresses

All of the top 50 attacking IP addresses were engaging in port scanning (see top targeted ports section below). Most (82%) of the top attacking IP addresses had a follow-up plan that included credential stuffing on RFB/VNC port 5900 and SSH port 22, HTTP/S attacks on ports 443 and 8080, and spamming on SMTP port 25.

The following IP addresses launched attacks against RFB / VNC port 5900 all over the world:

These port 5900 attacks are new activity as of June 2019 and continued through October 31, 2019. We have opened up a public threat hunting investigation on Twitter to uncover what is going on with these attacks and will be looking to share our findings and ask questions soon. Join the conversation on Twitter.

Top Targeted Ports

SMB port 445 was the number one attacked port in Asia during the fall of 2019. In a distant second place was port, VNC 5900, which was attacked all over the world during this time period. SMB port 445 has been a top targeted port since the release of the Eternal Blue exploit in April 2017. However, targeting VNC port 5900 is not typically at the top of the list, hence the threat hunting investigation we are doing on Twitter mentioned previously. SSH port 22 targeting, which followed in position 3, is activity we see globally on a consistent basis. This activity is typically associated with credential stuffing attacks (see top attacked SSH credentials) and IoT botnet building.

Both SMB and SSH are commonly targeted because exploiting a vulnerability on either of these services can give a malicious actor access to the entire system. HTTP port 80 and the encrypted HTTP port 443 were in the fourth and fifth most attacked positions. The only port uniquely targeted in Asia during this time period was the unassigned TCP port 22225. Given the ports that were targeted, vulnerability scanning, and credential stuffing attack types seen against systems in Asia in the fall of 2019, it is clear that attackers are targeting applications in Asia.

Conclusion

In general, the best approach a security team can take as defenders in this modern threat landscape is one of “assume breach.” This is not a FUD (fear, uncertainty, and doubt) position, this is a realistic position backed up by the volume of attack traffic all systems touching the Internet receive, the likelihood of vulnerabilities existing, and the number of compromised credentials available to attackers. When you take an “assume breach” defensive position, you are collecting attack traffic and monitoring your logs. You can use this high-level attack data to compare against the attack traffic directly hitting your own network. This will help you rule out run-of-the-mill attack traffic, or help you determine whether or not you are being targeted, in which case, investigating the attack sources and patterns is a worthwhile activity.

Locking down any of the top targeted ports that do not absolutely require unfettered Internet access should be completed as soon as possible. And because default vendor credentials are known by attackers, all systems should be hardened before being deployed and protected with multi-factor authentication.

Additionally, the volume of breached credentials in 2017 was so large that usernames and passwords should be considered “public,” therefore all organizations should have credential stuffing protection in place. Particularly for any system with remote authentication. See F5 Labs report Lessons Learned from a Decade of Data Breaches for more data on these breached passwords.

Security Controls

To mitigate the types of attacks discussed here, we recommend the following security controls be put in place: