"Cloud Server Abuse Leads to Huge Spike in Botnet Scanning"

Netscout has announced that malicious actors are increasingly abusing free cloud services, which has led to a significant spike in botnet scanning activity.  Netscout typically sees 10,000-20,000 IP addresses conducting internet scans every day.  However, the company observed an increase to more than 35,000 devices on December 8 and another spike that reached 43,000 devices on December 20.  According to the company, the number of source IPs associated with scanning activity saw a sharp increase on several days since, peaking on January 5, with nearly 1.3 million IPs.  A majority of the IPs are associated with the US, China, Vietnam, Taiwan, and Russia.  Researchers at Netscout noted that analysis of the activity has uncovered a rise in the use of cheap or free cloud and hosting servers that attackers are using to create botnet launch pads.  These servers are used via trials, free accounts, or low-cost accounts, which provide anonymity and minimal overhead to maintain.  The researchers believe the scanning represents reconnaissance activity, with hackers using these new botnets to find vulnerabilities they can exploit.  The researchers noted that the most commonly targeted ports are associated with HTTP, HTTPS, RDP, SIP, and other types of web servers, and there has also been an increase in scanning for email servers.  The researchers stated that the unprecedented growth of malicious botnets in the cloud confirms that a dangerous new wave of cybercrime is underway.

SecurityWeek reports: "Cloud Server Abuse Leads to Huge Spike in Botnet Scanning"