IoT Devices in Password-Spraying Botnet
Microsoft is warning Azure cloud users that a Chinese controlled botnet is engaging in “highly evasive” password spraying. Not sure about the “highly evasive” part; the techniques seem basically what you get in a distributed password-guessing attack:
“Any threat actor using the CovertNetwork-1658 infrastructure could conduct password spraying campaigns at a larger scale and greatly increase the likelihood of successful credential compromise and initial access to multiple organizations in a short amount of time,” Microsoft officials wrote. “This scale, combined with quick operational turnover of compromised credentials between CovertNetwork-1658 and Chinese threat actors, allows for the potential of account compromises across multiple sectors and geographic regions.”
Some of the characteristics that make detection difficult are:
- The use of compromised SOHO IP addresses
- The use of a rotating set of IP addresses at any given time. The threat actors had thousands of available IP addresses at their disposal. The average uptime for a CovertNetwork-1658 node is approximately 90 days.
- The low-volume password spray process; for example, monitoring for multiple failed sign-in attempts from one IP address or to one account will not detect this activity.
Subscribe to comments on this entry
Clive Robinson • November 6, 2024 8:56 AM
@ Folks,
Welcome to the “New word order” form of “clickbait” to get attention.
With regards the implicit question in,
That “highly evasive” is what advertising people once used to call a “hook”. It’s purpose is to activate your emotions not your reasoning.
Think of it like the “Camel Cowboy” of those deadly cigarette adverts,
“Yer all, wana look like him”
Right… Such was the typical sales and marketing reasoning (not sure if that said more about them or what they thought of prospective customers of time).
So “highly evasive” will become the new “think of the children” type dog whistle at some point, and in turn it will get replaced… Each in some way more desperately reaching than it’s predecessors.
Why, well it’s a side effect of what we outside the US call “The American way”. If you think back it was sufficiently well known or believed that you could get compensation money for “sipping hot coffee” and complaining that the person who had sold it had not given sufficient warning…
Thus there is a form of reasoning process that sort of says,
“If we don’t grab attention we will get sued.”
So we get “marketing speak” hooks as a legal protection… And as always underneath driving it will be the ever moving target of “best practice” for lawyers et al to drive things forward.
Which is why I’m reminded of the old,
“Build a better mouse trap…”
Saying of old, in that the person who comes up with a near perfect “marketing speak” removal tool will certainly have many people beat a path to their door…
Only these days it will be lawyers or worse[1] from sales and marketing execs wanting to eliminate the “rice bowl breaker” with maximum prejudice.
[1] For those who think I’m being a little over melodramatic, just consider what has so far happened to people that have developed “ad blockers” and similar for web browsers.