China: The land where the most IoT-based cyberattacks originate

Holmes discusses modus operandi for cybercriminals.

Threat intelligence returns control to organisations grappling with the onslaught of cyberattacks that they are at risk of encountering, says F5 Networks. Speaking at a media event during F5 Networks' Anticipate event in Singapore, David Holmes, Worldwide Security Evangelist, F5 Networks, noted that cybercriminals may spend as many as 100 days doing reconnaissance before they target an organisation, from probing a network, to reaching out to targets on LinkedIn.

"For many organisations, if the attack is successful, they won't know until 30 days later when all the customer data turns up on in a paste bin (editor's note: a text storage site)," said Holmes.

Threat intelligence explains what attackers want, where they come from, and how attacks work, giving organisations some basis on which to plan a defence strategy, Holmes said. For example, it is now known that massive increases in scanning activity occur across the Internet before a large attack.

"The three biggest attacks of all time came from Internet of Things (IoT) devices. They were built from the scanning activity we were worried about," Holmes said.

Scanners are used to identify vulnerable IoT devices, after which a loader targets the device with malware, Holmes said. Splitting up the scanning and loading functions gives cybercriminals more flexibility to tailor malware uploads as they wish for monetisation, he explained.

The top country where scanners and loaders come from is China, which accounted for 44% of attack activity from IoT devices in Q316, and remained in the lead in Q416 with 21% of all attack activity according to The Hunt for IoT volume 2 study from F5 Networks. Vietnam was the No. 2 source of cyberattacks in Q316, falling to 6th in the rankings to account for 7% of attack activity in Q316, and 4% of activity the next quarter.

In terms of attack targets, Turkey ranked No. 4 in both Q3 and Q416, receiving, 776,900 and 780,028 attacks respectively. Hong Kong was also in both top 10 lists, ranking as the No. 8 target in Q316 (a victim of 274,428 attacks) and No. 5 in Q416 (260,579 attacks).