Lessons Learned From The Ramnit Botnet Takedown

In the security community, there is a popular adage that says, “It’s not a matter of if you’ll be breached, but when.” This statement is meant to remind us that our focus should not only be on preventing a breach, but must also include strategies to detect and remediate incidents when they occur.

The unfortunate fact is that despite this knowledge, most of the time organizations have no idea they have suffered a data breach or are under attack by hackers. When the source of the attack is finally identified, it’s often too late and the result is usually reputational harm and millions of dollars lost.

In a knowledge-driven era, data has become our worst enemy and biggest ally. Data can be the enemy when organizations are bombarded and overwhelmed with more events than can be processed. It is like finding the needle in the proverbial haystack, where the needle is abnormal behavior and the haystack all online communications. To be secure, every instance of abnormal behavior should be checked as it may represent botnet activity or similar threats.

Despite these challenges, with the proper resources, data can also be our greatest ally. Thanks to modern technology -- namely big data -- organizations can proactively look for outlier behavior and investigate and obtain the necessary threat intelligence to evaluate and mitigate security risks before further damage is done.

One such example of the successful use of Big Data involves the takedown of a well-known botnet. In February, Europol, along with Microsoft, Symantec, and AnubisNetworks, led the takedown operation of Ramnit. In this case, the massive haystack consisted of the communications generated between a global network of compromised machines and respective command and control servers, or C2s. C2s are centralized machines that are able to send commands and receive outputs of machines -- part of a botnet encrypted with multiple security layers to protect “the needle,” meaning the criminals behind the whole operation. Breaking and sinkholing the Ramnit botnet required patience and perseverance to understand how the botnet operated, how it was structured, and how it communicated with the C2.

The takedown
Before moving in, law enforcement needed intelligence on the botnet, namely its geographic dispersion and an understanding of the malware to identify communication protocols and C2 infrastructure mapping.

It took months to collect, aggregate, and analyze the Ramnit botnet data, which led to sinkholing the C2 infrastructure and delivering critical information to allow law enforcement to take over the C2s and arrest the criminals.

In the end, the takedown was a success and law enforcement took control of the C2 infrastructure. By accessing and analyzing threat data from a variety of sources, the takedown effectively minimized the presence of Ramnit and reduce botnet activity on the international scale with infected machines decreasing from over 3.2 million to less than 250,000 in the days following the operation.

A couple of months after the operation, we’ve seen an increase in Ramnit botnet activity, but it’s marginal when compared to the days prior to the takedown. This emergence of new activity highlights the importance of vigilance and constant monitoring of these types of threats as in many cases it can be like cutting the head off a Hydra.

While the average organization won’t find itself involved in a high stakes botnet takedown, there are a few key takeaways from the Ramnit takedown that can be applied to any security program:

Unfortunately, botnets don’t simply die, they are built to be resilient and survive even if the masterminds behind them are in prison. We can weaken them, but often they reemerge with a similar modus operandi and a new name. Organizations need to embrace an adaptive approach to security, understand the new threat actors, and the risks they may represent.