Global Malware Hackers Use Social Media to Escape Cyber Sleuths

Lorenzo Franceschi-Bicchierai2013-04-23 12:41:05 UTC

Malware has gone global, with Asia and Eastern Europe the two main malware hotspots, according to a new report from an online security company. The company says hackers are using new techniques, such as exploiting social media, to escape detection.

According to a report published Tuesday by online security firm FireEye, there were 185 countries hosting "command and control" (C&C) servers in 2012. These servers are the central nodes that send commands to malware-infected computers. By comparison, in 2010 and 2011, the company detected C&C servers in 150 and 130 countries, respectively.

For Rob Rachwald, director of market research at FireEye, the global spread of malware is not only a byproduct of more countries going online and having a stronger infrastructure — it's also because creating malware is becoming relatively easy.

"You really don't need to do a lot in order to develop your own malware package," he says.

To better illustrate how malware spreads globally, FireEye has created an interactive map displaying the results of its report. For this study, the company has monitored and analyzed more than 12 million so-called "callbacks" across thousands of infected computers. Callbacks are connections from malware-infected computers to C&C servers.

Despite being present in virtually every country in the world, the numbers clearly indicate where the two main malware hubs are.

"There's really two centers of gravity for these types of thing," Rachwald says. "One is Asia, and the other one is Eastern Europe."

In fact, China, Korea, India, Japan and Hong Kong account for 24% of the world's volume of callbacks. Eastern Europe, including Russia, Poland, Romania, Ukraine, Kazakhstan and Latvia, is close with 22%. While 44% of callbacks still originate from the United States, the researchers note that number is deceiving, because a lot of C&C servers are located in the US to prevent investigators from easily identifying the origins of the attacks.

The researchers also report that cyber criminals are adapting and embracing new ways of escaping detection by using social media networks like Facebook, Twitter and even the Chinese search giant Baidu.

"It's actually an evasion technique," Rachwald says. "It's a way to avoid being detected, to try to look as normal as possible."

Hackers are making malware that, instead of connecting to traditional C&C servers, which would be easier to detect, connects with social networks or search engines to receive updates. This is a technique researchers have already seen in recent cyberattacks. The cyberespionage malware dubbed Miniduke used fake Twitter accounts to connect to C&C servers.

Another interesting finding is that 89% of every "advanced persistent threat" (APT) — a word commonly used to refer to sophisticated and long-standing cyber attacks — are carried out with Chinese-made tools. Rachwald notes that this doesn't mean that the Chinese government or even Chinese hackers are behind all those attacks, but simply that the hackers, wherever they are, use tools that were first developed in China.

Rachwald compares this malware proliferation to what happens in real life, when different countries copy technology or weapons (like drones) developed in other nations.

"That type of cross-pollination is much, much faster in the cyber world," he says, pointing out that it's much easier to copy or reverse-engineer malicious code than physically build a missile or a drone.

The most-used malware tool is called "Gh0st RAT" (which stands for Remote Administration Tool), a type of trojan that takes control of a computer and can log a user's every keystroke, take screenshots of what appears on the screen and even turn on and off the webcam to spy on the computer's owner.

The researchers finally note that the United States is still the primary target of most cyberattacks, "due to a very high volume and concentration of intellectual property and digitized data," the report reads. That's why 66% of APT-focused command and control servers are actually hosted in the United States.

Image via iStockphoto, ktsimage

Topics: malware, Tech, U.S., World if(window.pageChanged) window.omni({"channel":"tech","content_type":"article","top_channel":"tech","content_source_type":"Internal","content_source_name":"Internal","author_name":"Lorenzo Franceschi-Bicchierai","age":"0","pub_day":23,"pub_month":4,"pub_year":2013,"pub_date":"04/23/2013","isPostView":true,"post_lead_type":"Default"}); metaData = {"link":[["canonical","http://mashable.com/2013/04/23/global-malware-report/"],["image_src","http://rack.1.mshcdn.com/media/ZgkyMDEzLzA0LzIzLzI1L0dsb2JhbE1hbHdhLmExZWYwLmpwZwpwCXRodW1iCTcyMHg3MjAjCmUJanBn/3a417fb8/06f/Global-Malware.jpg"]],"meta_property":[["og:url","http://mashable.com/2013/04/23/global-malware-report/"],["og:title","Global Malware Hackers Use Social Media to Escape Cyber Sleuths"],["og:type","article"],["og:site_name","Mashable"],["og:image","http://rack.1.mshcdn.com/media/ZgkyMDEzLzA0LzIzLzI1L0dsb2JhbE1hbHdhLmExZWYwLmpwZwpwCXRodW1iCTcyMHg3MjAjCmUJanBn/3a417fb8/06f/Global-Malware.jpg"],["og:article:published_time","2013-04-23T12:41:05Z"],["og:article:modified_time","2013-04-23T12:41:14Z"]],"meta_name":[["description","A new report reveals that malware has spread to 185 countries, and that cyber criminals are using new techniques, including exploiting social networks. "],["keywords",["malware","cybersecurity","uncategorized","tech","us","world"]],["twitter:title","Global Malware Hackers Use Social Media to Escape Cyber Sleuths"],["twitter:description","Malware has gone global, with Asia and Eastern Europe the two main malware hotspots, according to a new report from an online security company. The company says hackers are using new techniques, such ..."],["twitter:image","http://rack.3.mshcdn.com/media/ZgkyMDEzLzA0LzIzLzI1L0dsb2JhbE1hbHdhLmExZWYwLmpwZwpwCXRodW1iCTU2MHg3NTAKZQlqcGc/842f012f/06f/Global-Malware.jpg"],["twitter:site","@mashable"],["twitter:url","http://mashable.com/2013/04/23/global-malware-report/"],["twitter:creator","@mashable"],["twitter:card","photo"],["twitter:image:width","560"],["twitter:image:height","750"]],"short_url":[["short_url","http://on.mash.to/15EsRhK"]]};

View the original article here