Analyzing Adversary Botnets for Offensive Cyber Operations - Joseph Slowik

Analyzing Adversary Botnets for Offensive Cyber Operations

Speakers: Joseph Slowik, Data Minor / Parales

Conference: Disobey

YouTube: https://www.youtube.com/watch?v=nk_1-5D5Avw

Overview

Joseph Slowik's talk, "Weaponizing the Neutral Web: Analyzing Adversary Botnets for Offensive Cyber Operations," delves into the evolving landscape of cyber threats, specifically focusing on how malicious actors, including state-sponsored entities, are leveraging compromised third-party infrastructure for sophisticated operations. The presentation offers a comprehensive perspective, blending elements of defensive security, threat intelligence, and offensive cyber operations, while also confronting the complex ethical and policy dilemmas inherent in responding to these threats.

Slowik introduces the concept of the "neutral web" – systems that are neither directly owned by adversaries nor primary victims, yet are weaponized as intermediate relays. He meticulously traces the evolution from traditional botnets to more advanced operational relay box (ORB) networks, highlighting their increasing sophistication, resilience, and the profound challenges they pose to global cybersecurity. The talk is particularly salient for defenders grappling with persistent and highly deniable attacks, as it pushes the audience to reconsider conventional response mechanisms and explore the controversial realm of active countermeasures and cross-border cooperation.

The core message underscores a critical shift: the internet's interconnectedness, once a strength, is now being exploited to create multi-layered attack infrastructure that renders traditional security controls obsolete. Slowik argues that a purely passive defensive posture is no longer sufficient, advocating for a proactive and globally coordinated approach to address a problem that transcends national borders and impacts critical civilian infrastructure worldwide. This discussion is vital for anyone involved in cybersecurity, from practitioners to policymakers, seeking to understand and counter the most advanced and persistent threats of our time.

Background

▶ Watch: Welcome and talk overview: weaponizing the neutral web. (0:00)

The concept of a botnet – a network of compromised machines controlled by an adversary for malicious purposes – has been a cornerstone of cyber threats for decades. Historically, these networks have been primarily associated with criminal activity, used for actions such as distributed denial of service (DDoS) attacks, proxying traffic, and credential brute-forcing. A classic example is Mirai, which emerged in 2016, notorious for infecting Internet of Things (IoT) devices, particularly SOHO routers and network-attached storage (NAS), to create massive DDoS-for-hire campaigns. The leakage of Mirai's source code further democratized its use, leading to numerous variants, including more recent ones like the Kimwolf botnet, which continues to exhibit significant scale and impact. Traditionally, these botnets operated with a relatively single, undifferentiated layer of compromised hosts between the attacker's controller and the victim.

However, the "neutral web" introduces a critical dimension to this threat model. Slowik defines the neutral web as those endpoints or hosts that are neither directly owned nor controlled by adversaries, nor are they the intended ultimate victims. Instead, they serve as a means to an end, facilitating malicious action against other targets. This infrastructure includes a wide array of devices: consumer-grade IoT, small office/home office (SOHO) routers, NAS devices, smart TVs, and even enterprise-grade equipment like VPN concentrators (e.g., Avantes, Fortunets, Citrix devices) that have been compromised. The goal is to leverage these otherwise benign systems as intermediaries, filtering malicious traffic to induce anonymity, scale operations, or amplify attacks like DDoS.

Beyond criminal enterprises, state-directed actors have also historically leveraged botnets for geopolitical objectives, demonstrating their utility beyond mere financial extortion. Notable instances include the extensive DDoS campaigns against critical civilian infrastructure and government services in Estonia (2007) and Georgia (2008), which coincided with or immediately preceded physical conflicts. These operations provided a degree of deniability, as the attacks were routed through a network of compromised machines, making direct attribution challenging. Similarly, Operation Ababil (2011-2012), linked to Iranian state actors, orchestrated a series of DDoS attacks against US financial institutions during periods of heightened tensions. While these state-sponsored activities were often characterized as "cyber annoyance" rather than full-scale cyber warfare, they highlighted the potential for botnets to serve political and messaging purposes, disrupting services and amplifying civilian concern without direct destructive impact. A key commonality across these historical examples was the indirect use of capabilities, the disruptive rather than destructive nature of attacks, and a pervasive lack of consequence for the perpetrators due largely to the obfuscation provided by the neutral web.

Key Findings

▶ Watch: What is the 'Neutral Web'? Endpoints in between. (4:00)

Slowik's core finding centers on the significant evolution of adversary infrastructure from traditional botnets to more sophisticated operational relay box (ORB) networks, also known as proxy networks. This shift represents a fundamental change in how adversaries leverage the neutral web, moving from a single layer of compromised hosts to multi-layered, multi-hop architectures between the attacker's controller and the victim. This increased complexity provides robust obfuscation of traffic origins, making it exceedingly difficult for defenders to trace attacks back to their source.

A critical contribution of ORB networks is their ability to establish highly survivable and deniable command and control (C2) channels. By distributing C2 traffic across numerous compromised, geographically diverse, and dynamically rotating nodes, adversaries can maintain persistent access and control even when individual nodes are identified or taken offline. This resilience contrasts sharply with traditional botnets, where the takedown of a central C2 server could cripple an entire operation.

Furthermore, the talk emphasizes that ORB networks are expanding beyond their historical use for DDoS and simple proxying. They are increasingly enabling more concerning activities, including low-and-slow intrusions into critical civilian infrastructure such as electric utilities, transportation networks, and water treatment plants. This signifies a move from mere "cyber annoyance" to operations with potentially destructive and life-threatening consequences. The division of labor within this ecosystem is also a key finding: specialized entities are now responsible solely for building and maintaining these complex proxy networks, distinct from the threat actors who actually utilize them for offensive operations. This specialization enhances the scale, quality, and deniability of the infrastructure available to adversaries.

Slowik highlights that traditional defensive measures, such as blocking individual Indicators of Compromise (IOCs) like IP addresses, are rendered largely ineffective against ORB networks. The dynamic and rapidly rotating nature of the compromised nodes means that blocking one IP is akin to a "Sisyphean task," as adversaries can instantly pivot to thousands of other available relays. Attempts at network takedowns, even by government entities, have often proven temporary, with adversaries demonstrating a rapid ability to reconstitute their capabilities, akin to the mythical Hydra growing more heads. Finally, Slowik notes that advanced threat actors have learned from past disclosures, such as the Snowden leaks, adopting "best of breed" techniques from intelligence communities of the early 2010s to construct their current resilient and deniable infrastructure.

Technical Deep Dive

▶ Watch: Definition of a botnet and its malicious applications. (4:50)

The technical foundation of ORB networks relies on the widespread availability of vulnerable "neutral web" devices. Adversaries primarily build these environments by exploiting common security weaknesses that persist across consumer and enterprise hardware. Key methods include leveraging default credentials that users fail to change upon setup and exploiting plus-one-day or even many-day vulnerabilities in unpatched devices. This includes a vast array of equipment, from common SOHO routers and Synology NAS devices to more specialized enterprise hardware like Avante EPMM appliances. Once compromised, these devices are incorporated into a multi-tiered controller environment, forming extensive networks of relays that can number in the thousands or even millions.

Unlike traditional botnets, which might involve a single layer of compromised "zombies," ORB networks employ multiple hops, creating a complex chain of relays. This layered approach significantly increases the operational security (opsec) for the attacker by obfuscating the true origin of malicious traffic and providing robust, survivable C2 channels. If one hop is identified or taken down, the adversary can dynamically rotate to another, maintaining persistent access and control. This dynamic rotation capability is a critical technical advantage, allowing adversaries to evade traditional IP-based blocking and tracking mechanisms.

Slowik provides concrete examples of state-sponsored actors leveraging these advanced proxy networks:

• Russian Actors (GRU Sandworm): The VPNFilter and its successor, Cyclops Blink malware, are prime examples. These were hybrid botnet-like environments, more complex than traditional botnets, which approached the definition of ORB networks. Affiliated with the GRU's Sandworm group, these malware strains compromised numerous devices, including those with Operational Technology (OT) targeting functionality. While thankfully disrupted before executing actions on objectives, they were assessed to be linked to desired disruptive effects on Ukraine and potentially its supporting entities. This demonstrated the capability of state actors to weaponize the neutral web for strategic impact on critical infrastructure.

• PRC Actors (Vault Typhoon): More recently and prominently, Vault Typhoon, a threat actor linked to the People's Republic of China, has been associated with the KV botnet. This ORB network has been responsible for extensive probing of critical infrastructure in the electric sector, transportation, and other vital services, largely within North America. The KV botnet exemplifies the strategic use of compromised routers and similar devices, not just to victimize their owners, but to aggregate them into vast, complex networks. These networks then serve as a resilient platform for cyber operators to filter traffic to ultimate victims, providing both deniability and persistence for long-term intelligence gathering and potential pre-positioning for future disruptive or destructive operations. Slowik cautions that the operational model of Vault Typhoon is highly portable and could easily be adapted for operations in other regions, including Europe.

The speaker also references his own prior work, including presentations on "midpoint exploitation" and the NTC Vulcan files, specifically mentioning the scan v tool, which is designed as a botnet/proxy network builder. This historical context underscores that while ORB networks have recently gained prominence, the underlying concepts and techniques have been explored and developed over more than a decade within intelligence communities, with other threat actors now adopting these "best of breed" approaches.

Demo / Proof of Concept

▶ Watch: Classic example: Mirai botnet for DDoS-for-hire. (6:45)

While Joseph Slowik's presentation did not include a live demonstration or proof of concept of an ORB network in action, he referenced his previous work that delves into the technical construction and exploitation of such environments. Specifically, he mentioned past presentations on "midpoint exploitation," which explores how intermediate compromised systems can be leveraged to filter and shape malicious traffic, and his detailed work on the NTC Vulcan files, which included discussions of the scan v tool. This tool is described as a "botnet builder or a proxy network builder," indicating a focus on the practical mechanisms for creating and managing the types of multi-layered, deniable infrastructure that constitute ORB networks. These prior works serve as a technical foundation for understanding the capabilities and implications discussed in the current talk, demonstrating that the principles of weaponizing the neutral web are well-established and have been explored in depth.

Defensive Implications

▶ Watch: Mirai's legacy: leaked code, ongoing impact, and scale. (8:00)

The emergence and proliferation of ORB networks present a profound challenge to conventional cybersecurity defense strategies, rendering many traditional controls ineffective. Slowik emphasizes that blocking individual Indicators of Compromise (IOCs), such as IP addresses, is a "Sisyphean task" against dynamically rotating proxy networks. With thousands of nodes that can change rapidly or on a timed basis, defenders are left "chasing a moving target," a "red queen" race where they can never truly catch up. This renders traditional threat intelligence sharing and blocking mechanisms largely meaningless.

To counter this, Slowik proposes several critical shifts in defensive thinking and action:

1. Enhanced Attack Surface Management: The foundational defense remains robust network hygiene. This includes enforcing multi-factor authentication (MFA) on all remote access points (e.g., RDP, SSH, VPNs) to prevent brute-forcing, diligently patching all external-facing devices, and generally hardening infrastructure to make initial access and C2 establishment more difficult. While this has been a cybersecurity mantra for years, its importance is amplified in an era where unmaintained devices are readily weaponized.

1. Advanced Research and Analysis: Defenders must move beyond tracking individual IOCs and instead analyze these threats as dynamic networks. This requires sophisticated capabilities to understand the extent and topology of ORB environments. Such analysis often necessitates access to backbone net flow data and other large-scale telemetry, which is typically only available to major telecommunications providers or well-resourced government entities, making it cost-prohibitive for many organizations. The goal is to "swim upstream" to identify and neutralize the controllers rather than the easily replaceable endpoint nodes.

1. Targeted Takedowns of Controllers: While taking down endpoints is largely futile, identifying and neutralizing the ORB controllers is a more effective long-term strategy. However, this is exceptionally difficult due to the multi-layered obfuscation employed by adversaries. Even when takedowns are attempted, as seen with VPNFilter and the KV botnet, adversaries often demonstrate a rapid ability to reconstitute their infrastructure, highlighting the need for persistent, rather than one-off, disruption efforts. The Department of Justice's attempts, sometimes involving "forced patching" without rebooting, have shown limited success, as adversaries could simply regain control upon system restart.

1. Vaccinating the Neutral Web: Slowik introduces the radical concept of "vaccinating" compromised devices to prevent reinfection. This would involve deploying capabilities to patch or secure vulnerable devices, even those not directly owned by the responding entity. This raises significant legal, ethical, and jurisdictional questions: What if such actions inadvertently "brick" devices? What are the liabilities? And how do these actions apply to devices located in other countries, possibly on different continents? These are complex policy considerations that governments and international bodies must urgently address.

1. International Cooperation and Asset Owner Responsibility: Given the borderless nature of ORB networks, a "go-it-alone" approach is unsustainable. Effective countermeasures require robust cross-border cooperation among multiple jurisdictions, governments, and private industry. Furthermore, Slowik challenges the notion of passive ownership, suggesting that owners of end-of-life, default-credentialed, or vulnerable devices have a responsibility as "good internet citizens" to maintain their infrastructure. Failure to do so actively contributes to the global threat landscape, enabling serious campaigns against critical national infrastructure. This calls for a reimagining of individual and collective responsibilities in a hostile online environment.

The overall implication is that a purely passive defensive posture is no longer viable. As adversaries increasingly weaponize the neutral web for potentially destructive campaigns against critical infrastructure, a shift towards active, potentially offensive cyber measures, coupled with unprecedented international cooperation and a re-evaluation of asset owner responsibilities, becomes a necessary, albeit ethically complex, path forward.

Key Takeaways

• Evolution to Advanced Proxy Networks: Adversaries, including state-sponsored groups like GRU Sandworm and Vault Typhoon, have evolved from traditional botnets to multi-layered Operational Relay Box (ORB) networks that provide robust obfuscation, survivable C2, and dynamic infrastructure rotation.
• Weaponization of the Neutral Web: The "neutral web" (compromised IoT, SOHO routers, NAS, VPN concentrators) is actively weaponized to facilitate attacks ranging from financial extortion to sophisticated, long-term intrusions into critical national infrastructure.
• Ineffectiveness of Traditional Defenses: Conventional defensive measures, such as blocking individual Indicators of Compromise (IOCs), are largely ineffective against ORB networks due to their dynamic, rapidly changing nature and ability to reconstitute after takedown attempts.
• Need for Active Countermeasures: A purely passive defensive posture is unsustainable. Effective response requires a shift to active countermeasures, including focusing on neutralizing ORB controllers and potentially "vaccinating" compromised neutral devices, rather than just chasing endpoints.
• Complex Legal and Ethical Dilemmas: Deploying active countermeasures against neutral infrastructure, especially across international borders, raises significant legal, ethical, and policy questions that governments and international bodies must urgently address.
• Global Cooperation and Shared Responsibility: Combating ORB networks necessitates unprecedented cross-border and multi-jurisdictional cooperation. Additionally, asset owners bear a responsibility to maintain their devices, as poor cybersecurity hygiene contributes directly to the global threat landscape.

About the Speaker(s)

Joseph Slowik is a seasoned cybersecurity professional with over 15 years of experience in the field. He currently works in security at Data Minor and also operates his own company, Parales, where he focuses on teaching. Slowik has a diverse background, having contributed to various prominent organizations across both government and industry. His past roles include working at the MITRE Corporation, known for the MITRE ATT&CK framework, Los Alamos National Laboratory, and private sector companies such as Huntress, DragoS, and DomainTools. Hailing from the US, Slowik is a strong advocate for transatlantic cooperation in cybersecurity, recognizing the borderless nature of cyber threats. He is passionate about exploring the ethical and policy dimensions of cybersecurity alongside its technical aspects, particularly concerning the weaponization of the neutral web.