Photo - Costin Raiu, Director, Global Research and Analysis Team, Kaspersky Lab.
Malaysia is among the top 10 countries affected by a global underground market selling more than 70,000 hacked servers, said Russian cybersecurity solutions company Kaspersky Lab.
Costin Raiu, director, Global Research and Analysis Team, Kaspersky Lab, said the company's researchers investigated a global forum where cybercriminals can buy and sell access to compromised servers for as little as US$6 each.
Raiu said the xDedic marketplace, which appeared to be run by a Russian-speaking group, currently lists 70,624 hacked Remote Desktop Protocol (RDP) servers for sale.
The xDedic marketplace may have opened for business in 2014, and has grown significantly in popularity since the middle of 2015, he said. In May 2016, it listed 70,624 servers from 173 countries for sale, posted in the names of 416 different sellers. The top 10 countries affected are: Brazil, China, Russia, India, Spain, Italy, France, Australia, South Africa and Malaysia.
Raiu said that many of the servers host or provide access to popular consumer websites and services and some have software installed for direct mail, financial accounting and Point-of-Sale (PoS) processing.
He said these servers can be used to target the owners' infrastructures or as a launch-pad for wider attacks, while the owners, including government entities, corporations and universities.
Raiu said xDedic was an example of a new kind of cybercriminal marketplace: well-organised and supported and offering everyone from entry-level cybercriminals to APT groups fast, cheap and easy access to legitimate organisational infrastructure that kept their crimes below the radar for as long as possible.
The group behind xDedic appeared to be Russian-speaking, and claimed that it just provided a trading platform and has no links or affiliations to the sellers, he said.
A European internet service provider (ISP) first alerted Kaspersky Lab to the existence of xDedic and the companies worked together to investigate how the forum operated.
Hackers break into servers, often through brute-force attacks, and bring the credentials to xDedic, said Raiu.
The hacked servers are then checked for their RDP configuration, memory, software, browsing history and more - all features that customers can search through before buying. After that, they are added to a growing online inventory that includes access to:
- Servers belonging to government networks, corporations and universities
- Servers tagged for having access to or hosting certain websites and services, including gaming, betting, dating, online shopping, online banking and payment, cell phone networks, ISPs and browsers
- Servers with pre-installed software that could facilitate an attack, including direct mail, financial and PoS software
- All supported by a range of hacking and system information tools.
The servers' legitimate owners, reputable organisations and including government networks, corporations and universities are often unaware that their IT infrastructure has been compromised, added Raiu.
"xDedic is further confirmation that cybercrime-as-a-service is expanding through the addition of commercial ecosystems and trading platforms," he said.
Sign up for CIO Asia eNewsletters.