English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

The malware and botnet phenomenon is among the most significant threats tocybersecurity today. Consequently, law enforcement agencies, securitycompanies, and researchers are constantly seeking to disrupt these maliciousoperations through so-called takedown counter-operations. Unfortunately, thesuccess of these takedowns is mixed. Furthermore, very little is understood asto how botnets and malware delivery operations respond to takedown attempts. Wepresent a comprehensive study of three malware delivery operations that weretargeted for takedown in 2015-16 using global download metadata provided by amajor security company. In summary, we found that: (1) Distributed deliveryarchitectures were commonly used, indicating the need for better securityhygiene and coordination by the (ab)used service providers. (2) A minority ofmalware binaries were responsible for the majority of download activity,suggesting that detecting these "super binaries" would yield the most benefitto the security community. (3) The malware operations exhibited displacing anddefiant behaviours following their respective takedown attempts. We argue thatthese "predictable" behaviours could be factored into future takedownstrategies. (4) The malware operations also exhibited previously undocumentedbehaviours, such as Dridex dropping competing brands of malware, or Dorkbot andUpatre heavily relying on upstream dropper malware. These "unpredictable"behaviours indicate the need for researchers to use better threat-monitoringtechniques.

Marked for Disruption: Tracing the Evolution of Malware Delivery Operations Targeted for Takedown