Leveraging ASNs and Pivoting to Uncover Malware Campaigns

Identifying and Mitigating Complex Malware Campaigns with ASNs

This week, I spent a good deal of time going down some rabbit holes – all of which were fascinating. However, this is an example where some of the work we do we would like to share but aren’t always able. In this instance, we found confidential information related to a hacked mail server within malware we detonated. The malware was configured to use a government mail server as a relay to email out keylogger data.

In each case of the malware, there were essentially two victims, the victim(s) of the malware, and the operators of the mail server being used in the attacks. We’ve notified the department that manages the mail server of the compromise, and of the credentials used to send mail with their server.

This brings me to the “how” of it all. Cyber threat intelligence (CTI) experts and investigators face the daunting challenge of identifying and mitigating complex malware campaigns. These campaigns, orchestrated by sophisticated threat actors, often leverage diverse infrastructure and techniques to evade detection and compromise targets.

In this blog, we’ll explore in detail how CTI experts can harness the power of Autonomous System Numbers (ASNs) and employ pivoting techniques to uncover and analyze malware campaigns. By understanding the nuances of ASNs and mastering effective pivoting strategies, CTI professionals can enhance their capabilities in threat detection, attribution, and response.

Understanding ASNs

Autonomous System Numbers (ASNs) serve as unique identifiers assigned to networks participating in the global routing system. Each ASN corresponds to an organization or entity that controls a portion of the internet’s IP address space. By analyzing ASNs, CTI experts can gain valuable insights into the infrastructure utilized by threat actors to conduct malicious activities.

These insights include identifying the origins of malicious traffic, pinpointing hosting providers associated with malware distribution, and tracing connections between seemingly disparate cyber threats.

Pivoting with ASNs

Pivot

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.