Not your grandaddy’s botnet

The latest generation of botnets, architected into large-scale multi-tiered proxy networks, is making traditional indicator-based defenses obsolete, empowering nation-state and cybercrime threat groups – and posing new and thorny technical and policy dilemmas for defenders.

For years, researchers have cataloged the phenomenon with growing alarm, veteran security researcher Joe Slowik told ISMG. Unlike traditional, flat botnets, consisting of a simple layer of compromised devices, these next-gen proxy networks are built with multiple tiers, so that adversary traffic can be routed and re-routed, more effectively concealing its origin and its nature.

“It’s almost a TOR-like effect,” he said following his presentation on the topic at the recent Critical Effect conference in Washington, D.C., and referring to anonymity-bestowing network protocol once known as The Onion Router. Proxy networks of residential consumer devices such as compromised home office routers “allow for both more resilient and more stealthy operations,” he explained.

Read more at Gov Info Security