In the Fight Against Cybercrime, Takedowns Are Only Temporary

Disrupting access to servers and infrastructure continues to interfere with cybercrime activity, but its far from a perfect strategy.

In November, 10 months after an international task force shut down Emotets servers and infrastructure, the botnet came back online.
The new Emotet, which spread malware in a spurt of Spanish-language messages in the latter half of the month, consisted of two botnets using different encryption for communication and additional commands than the previous version, which was taken down in January. At the time of the takedown, the threat had accounted for
7% of attacks on organizations worldwide
and often delivered malware or ransomware to the 1.6 million machines compromised by attackers.
Emotets revival highlightshow many botnet takedowns lack permanence. Along with the resuscitation of TrickBot in 2020, the resurgence of Emotet demonstrates that the industry and government agencies should take a hard look at whether the tactic needs to be revisited or revised, says David Monnier, a fellow with threat intelligence firm Team Cymru.
It is an incredibly valid question that we should be asking, as we do with anything: If you are not getting the results you want, should [you] be doing something different instead? he says. Are we getting better or is this [the movie] Groundhog Day?
Temporary Disruptions
More than a decade ago, Microsoft pioneered using legal measures to allow private companies to take down botnets. More than a score of takedowns later, multi-organizational efforts — which now often include law enforcement and private-industry partners — often only temporarily disrupt botnet infrastructures. Trickbots operators, for example,
started reviving the network within a few weeks of the initial takedown
.
In Emotets case,
the takedown led to a 10-month hiatus
, during which the botnets operators appear to have made changes, such as moving away from the increasing use of cybercriminal services for parts of the infection and payload chain, says Scott Scheferman, a principal cyber strategist at Eclypsium, a firmware- and hardware-security firm.
These actors have a lot of resilience and a ton of money. As a result, they can adapt easily, he says. They are going back to the triad of distribution, a Trickbot loader, and ransomware drop. They are pulling back into themselves centrally, rather than using everything as a service.
The fundamental problem for defenders is that while infrastructure can be disrupted, the people behind the attacks — often protected by complicit nations with liberal cybercrime laws — are unfettered and remain able to work to rebuild their malicious distribution networks. While the United States and other nations focus on more aggressive measures to curtail cybercrime, in general, and ransomware, in particular, will help, cybercrime is too profitable for many groups to pare back their operations.
A lot of these sophisticated actors that have become prolific — the Emotet groups and REvil groups — they are really operating out of places where the West cant touch them, says Michael DeBolt, chief intelligence officer of threat-intelligence firm Intel 471, adding that such downsides do not make the activity not worthwhile. From a higher level, though, obviously disruption efforts against sophisticated groups should be the target of not just law enforcement, but also of private-industry groups.
In addition to taking down the infrastructure of specific actors, focusing on identifying and disrupting critical criminal infrastructure — such as bulletproof hosting — could also result in more long-term benefits, he adds. In 2011, for example, researchers discovered
95% of the sales revenues of spam-advertised products were handled by about a dozen banks
, which allowed financial authorities to disrupt a wide swath of criminal groups.
Defenders and government officials need to identify similar keystones in the current cybercrime landscape.
What this comes down to is really identifying pain points that can increase the time, money, and effort that the cybercriminals need to do business, DeBolt says. If we identify a server or back-end infrastructure and we take that down, we see, great, it does not completely cut the head off the snake, but it causes them to back off a little bit and rejig, and that is time, money, and effort for them.
Consistent Effort
Some takedown efforts have led to success. The takedown of the Necurs botnet — which acted as a distribution platform for other malware, such as GameOver Zeus and Trickbot — appears to have largely worked. The botnet, which had gone silent and previously returned, largely disappeared in March 2020 following
a takedown spearheaded by Microsoft and Bitsight
.
Still, many attackers learn from such actions and return, improving their tactics, techniques, and procedures (TTPs). Fortunately, defenders and law enforcement are also getting more efficient in takedown efforts, says Team Cymrus Monnier. While the balance currently seems to favor attackers, if disruption efforts take less time for defenders to accomplish and more time and effort for attackers to recover from, taking down servers and infrastructure — while temporary — will be worth it, he says.
There isnt necessarily a silver bullet or a single event that can disrupt these efforts, but consistent effort will keep up the pressure on groups and make cybercrime less profitable, the former US Marine says.
We have a saying in the Marine Corps: You have a choice between the pain of discipline or the pain of regret, Monnier says. We have to take the same approach, the same tenacity. As long as we make it harder for them, we have to do so.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
In the Fight Against Cybercrime, Takedowns Are Only Temporary