Botnets are increasingly being deployed for credential abuse, according to security company Akamai.
Data analyzed by Akamai of more than 7.3 trillion bot requests per month found a sharp increase in the threat of credential abuse, with more than 40% of login attempts being malicious, according to the company's State of the Internet/Security Report for Q4 2017.
Akamai said that many of the botnets traditionally responsible for DDoS attacks are being used to abuse stolen login credentials. Of the 17 billion login requests tracked through the Akamai platform in November and December, almost half (43%) were used for credential abuse.
The hospitality industry suffered was the biggest target of fraudulent credential attacks, with 82% of their login attempts being from malicious botnets.
The company added that while botnets are being turned to credentials abuse, there is still a consistent, and increasing, threat from DDoS attacks. The report showed a 14% year-on-year increase in DDoS attacks in Q4 2017.
The Mirai botnet, used in some of the largest and most disruptive DDoS attacks of 2016 is also still a threat. Mirai activity faded over 2017, but Akamai said it still saw a spike of nearly one million unique IP addresses from the botnet scanning the Internet in late November 2017, showing that it is still capable of explosive growth.
Akamai researchers have seen recent hacker activity turning to exploit remote code execution vulnerabilities in enterprise-level software to make enterprise systems part of the botnet threat. For example, hackers have been exploiting vulnerabilities in the GoAhead embedded HTTP server-which has 700,000 potential targets-and Oracle WebLogic Server. Aided by the disclosure of Spectre and Meltdown earlier this year, both vulnerabilities open the door to a new wave of attacks, including the surreptitious installation of crypto mining programs that tie up computing resources.
"A key motive of attackers has always been financial profit. In the past few years, we have seen adversaries move to more direct methods to achieve that goal such as ransomware," said Martin McKeay, senior security advocate and senior editor, State of the Internet / Security Report. "Crypto mining offers attackers the most direct avenue to monetize efforts by putting money immediately into their cryptowallets.
"Increased automation and data mining have caused a massive flood of bot traffic to impact websites and Internet services. Although most of that traffic is useful for Internet businesses, cybercriminals are looking to manipulate the powerful volume of bots for nefarious gains," said McKeay. "Enterprises need to watch who is accessing their sites to differentiate actual humans from both legitimate and malicious bots. Not all web traffic and not all bots are created equal."