These addresses are most likely used by the Fast Flux network owner as spoofed entities and are not genuine members of the Fast Flux network. Some of the associated IP addresses are in address space that is assigned to Fortune 100 companies. These networks empower threat actors to execute attack campaigns by utilizing network capabilities to host malware binaries, proxy communication to C2 servers, phishing websites, or proxy attacks on websites across the internet.Īkamai’s high visibility to both web and enterprise traffic gives us the ability to get new and unique insights on the behavior of such Fast Flux networks.Īccording to our research, we were able to track a botnet that is using Fast Flux techniques with more than 14,000 IP addresses associated with it, with most of the IP addresses originating from eastern Europe. Figure 1 shows an overview of such a network, which can also be referred to as a form of bulletproof hosting, that hosts various malicious services. Akamai’s research team has analyzed sophisticated botnet infrastructure that leverages Fast Flux techniques including domains, nameservers, and IP address changes. The Fast Flux network is typically used to make the communication between malware and its command and control (C2) server more resistant to discovery. The Fast Flux network concept was first introduced in 2006, with the emergence of Storm Worm malware variants.

How do these botnets remain resilient to detection?įast Flux is a DNS technique used by botnets to hide various types of malicious activities, such as phishing, web proxying, malware delivery, and malware communication, behind an ever-changing network of compromised hosts acting as proxies. These botnets incorporate new features and have bigger capabilities. Recently, we have seen large-scale botnets used to execute attacks rarely seen in the past.

Flux hacked client help