By Ray Birch
WASHINGTON—Credit unions face a new cyber-threat that’s helping crooks avoid detection as they infiltrate an organization’s network.
Called fast flux, the approach allows threat actors to maintain network redundancy and evade detection by preventing excessive focus on any single network resource, such as an IP address, name server, or domain name. This technique helps conceal network compromises that institutions might otherwise identify by monitoring frequently accessed IP addresses.
The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI) have issued a warning about the fraud tactic.
“Many networks have a gap in their defenses for detecting and blocking a malicious technique known as fast flux,” the agencies wrote in a joint release that included cyber security departments in Canada, New Zealand and Australia.
“This technique poses a significant threat to national security, enabling malicious cyber actors to consistently evade detection,” the agencies stated. “Malicious cyber actors, including cybercriminals and nation-state actors, use fast flux to obfuscate the locations of malicious servers by rapidly changing domain name system (DNS) records. Additionally, they can create resilient, highly available command and control (C2) infrastructure, concealing their subsequent malicious operations. This resilient and fast changing infrastructure makes tracking and blocking malicious activities that use fast flux more difficult.”
The agencies noted that when malicious cyber actors compromise devices and networks, the malware they use needs to “call home” to send status updates and receive further instructions.
“To decrease the risk of detection by network defenders, malicious cyber actors use dynamic resolution techniques, such as fast flux, so their communications are less likely to be detected as malicious and blocked,” the agencies said.
Single And Double Flux
The agencies said malicious cyber actors use two common variants of fast flux to perform operations:
- Single flux: A single domain name is linked to numerous IP addresses, which are frequently rotated in DNS responses. This setup ensures that if one IP address is blocked or taken down, the domain remains accessible through the other IP addresses (see image below).
- Double flux: In addition to rapidly changing the IP addresses as in single flux, the DNS name servers responsible for resolving the domain also change frequently. This provides an additional layer of redundancy and anonymity for malicious domains. Double flux techniques have been observed using both name server (NS) and canonical name (CNAME) DNS records, the agencies explained (see image below).
“Both techniques leverage a large number of compromised hosts, usually as a botnet from across the Internet that acts as proxies or relay points, making it difficult for network defenders to identify the malicious traffic and block or perform legal enforcement takedowns of the malicious infrastructure. Numerous malicious cyber actors have been reported using the fast flux technique to hide C2 channels and remain operational,” the agencies said.
Examples include bulletproof hosting (BPH) services offer Internet hosting that disregards or evades law enforcement requests and abuse notices. These providers host malicious content and activities while providing anonymity for malicious cyber actors. Some BPH companies also provide fast flux services, which help malicious cyber actors maintain connectivity and improve the reliability of their malicious infrastructure, the agencies said.
“Fast flux is another example of the evolving sophistication of cyber criminals’ ability to obfuscate their malicious activities,” Jeffrey Veltri, senior managing director at FTI Consulting, told CUToday.info. “It highlights the importance of financial institutions being vigilant in implementing robust detection and mitigation strategies and testing those strategies to ensure they are adapting to the adversaries’ techniques. The sophistication of cyber threat actors is only increasing, and fast flux is just another reminder of that reality. Attention to cybersecurity needs to keep pace to best position institutions to mitigate the risks.”