Attack Types of Top Attacking IP Addresses

Many of the IP addresses attacking Russian systems during the winter of 2019 were involved in abusive port scanning activity. As noted in the top attacked ports section, Microsoft SMB on port 445 was the highest targeted port, and that was seen across all of the top attacking IP addresses. We continued to observe high levels of attack traffic pointed towards VNC/RFB port 5900, although those levels are notably lower in Russia. As our sensor stack has evolved, we’ve noticed more IP addresses that are targeted on SMB port 445 at higher rates.

RM Engineering, which hosts a number of the top attacking IP addresses, does appear in the Russian threat landscape during this time period. One reason they don’t appear in the top attacking ASNs list could be that the attacks were at a lower volume. RM Engineering launched credential stuffing attacks that targeted RFB port 5900 and were received by systems all over the world. RM Engineering is new to our top threat actor network tracking as of June 2019, when the global campaign targeting RFB began, unlike OVH SAS, which has routinely shown up on top attacking network lists in our Hunt for IoT Report series for years.

Table 1. Top Attacking IP addresses and their attack types targeting Russian Systems, October 1, 2019 – December 31, 2019

Top Targeted Ports

Looking at top targeted ports and services can provide insight as to where attackers are focusing resources and what services they’re after. Russia had possibly the most distinct top attacked ports over this time period. As in most of the rest of the world, SMB port 445 was the number one attacked port in Russia (consistent with global attack activity since the Eternal Blue exploit was released in April 2017). We noticed a large uptick in volume of SMB port 445 attack traffic in this time period compared to the volume noted in our fall 2019 regional threat perspectives article about Russia. This can be attributed to our continuously evolving sensor network where we are observing the regional threat landscape from different postures.

In a distant second position was the Swiss Exchange port 7326. This traffic was first noticed in October. and is only targeting Russia. This is notable, given the potential financial implications and the fact that this was not a top attacked port anywhere else in the world during this time period. When looking at attacks on Russian systems, the only other port only targeted port was 21455.

In third position was SSH port 22. This activity was consistent all over the world—and we expect to see this. SMB port 445 and SSH port 22 are commonly targeted because exploiting a vulnerability on either port can give a malicious actor access to the entire system. Many of the remaining top targeted ports were those used for web applications, access, and email. This clearly indicate attackers went after applications and access to applications in Russia (as they did all across the world).

Notable in the Russian threat landscape was the relatively smaller number of attacks targeted towards VNC port 5900. This activity is atypical and was first noticed in July 2019. We are actively engaged in an ongoing investigation of this activity, much of which appears to be coming from Russia, although with the use of proxies and VPNs, we cannot be sure of attribution.