Leviathan: Command and Control Communications on Planet Earth
summary
Eighteen months of telemetry shows about 30 million malware callbacks and roughly 600–700k unique callbacks coming from sensors in 200+ countries, with education, tech, healthcare and finance as top verticals; 33,000 distinct port numbers appear (zeroaccess drives a big high‑port spike), about 20% of callbacks stay inside the victim country, the United States resolves ~24% of C2 IPs, hundreds of 200 Google variations and many spoofed AV/update domains appear, and geopolitical crises (Ukraine, Gaza) produce measurable callback spikes.
AI-written summary · about
chapters (18)
- 0:00FireEye
- 2:28Leviathan
- 5:50Worldwide malware ecosystem
- 8:42Tactics, techniques, and procedures
- 9:36Every industry vertical owned
- 10:40Callbacks: ebb and flow
- 11:11Knock Knock
- 12:14Hiding in Plain Site
- 15:09Hiding in plain "site"
- 16:58World C2 network map
- 18:16World C2 network heatmap
- 19:24Connectivity and malware
- 21:34The king of malware
- 23:49Callback destinations from South Korea
- 26:35Overlap: investigative headache
- 28:34Israel: traffic analysis
- 30:22Geopolitical reflection: Ukraine crisis
- 35:59Geopolitical reflection: Israel-Gaza crisis
related talks
56mCybersecurity & Privacy From The Global Lens
01h 27mSecuring at Scale Building Resilient Defences for a Growing Digital World
45mObserved Malicious Cyber Criminality During COVID in the African and Arab Regions
47mThe Secret Life of Enterprise Botnets
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
39mCommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
35mCrimeware Chaos: Empirical Analysis of HTTP-Based Botnet C&C Panels
47mDetecting and analyzing files-less malware