CenturyLink Announces New Threat Research and Operations Arm, Black Lotus Labs

Black Lotus Labs reveals global distribution, hiding technique of multitool botnet Necurs

MONROE, Louisiana, Feb. 28, 2019 /PRNewswire/ -- Furthering its dedication to helping protect the internet from malicious actors, CenturyLink, Inc. [https://c212.net/c/link/?t=0&l=en&o=2385509-1&h=53973982&u=http%3A%2F%2Fnews.centurylink.com%2F&a=CenturyLink%2C+Inc.] is sharing intelligence on the Necurs botnet uncovered by its new threat research and operations division, Black Lotus Labs [https://c212.net/c/link/?t=0&l=en&o=2385509-1&h=2326385566&u=https%3A%2F%2Fwww.centurylink.com%2Fbusiness%2Fsecurity%2Fblack-lotus-labs.html%3Frid%3Dblacklotuslabs&a=Black+Lotus+Labs].

Experience the interactive Multichannel News Release here: https://www.multivu.com/players/English/8238355-centurylink-black-lotus-labs/ [https://c212.net/c/link/?t=0&l=en&o=2385509-1&h=3373009282&u=https%3A%2F%2Fwww.multivu.com%2Fplayers%2FEnglish%2F8238355-centurylink-black-lotus-labs%2F&a=https%3A%2F%2Fwww.multivu.com%2Fplayers%2FEnglish%2F8238355-centurylink-black-lotus-labs%2F]

The mission of Black Lotus Labs is to leverage CenturyLink's network visibility to help protect customers and keep the internet clean. Among the ways Black Lotus Labs does this is by tracking and disrupting botnets like Necurs, a prolific and globally dispersed spam and malware distribution botnet which has recently demonstrated a hiding technique to both avoid detection and quietly amass more bots.

Read the Black Lotus Labs report on Necurs: https://www.netformation.com/our-pov/casting-light-on-the-necurs-shadow/ [https://c212.net/c/link/?t=0&l=en&o=2385509-1&h=2097207681&u=https%3A%2F%2Fc212.net%2Fc%2Flink%2F%3Ft%3D0%26l%3Den%26o%3D2385509-1%26h%3D4252663252%26u%3Dhttps%253A%252F%252Fwww.netformation.com%252Four-pov%252Fcasting-light-on-the-necurs-shadow%252F%26a%3Dhttps%253A%252F%252Fwww.netformation.com%252Four-pov%252Fcasting-light-on-the-necurs-shadow%252F&a=https%3A%2F%2Fwww.netformation.com%2Four-pov%2Fcasting-light-on-the-necurs-shadow%2F].

"Necurs is the multitool of botnets, evolving from operating as a spam botnet delivering banking trojans and ransomware to developing a proxy service, as well as cryptomining and DDoS capabilities," said Mike Benjamin, head of Black Lotus Labs. "What's particularly interesting is Necurs' regular cadence of going dark to avoid detection, reemerging to send new commands to infected hosts and then going dark again. This technique is one of many the reasons Necurs has been able to expand to more than half a million bots around the world."

Key Takeaways


-- Beginning in May of 2018, Black Lotus Labs observed regular, sustained
downtime of roughly two weeks, followed by roughly three weeks of
activity for the three most active groups of bots comprising Necurs.
-- Necurs' roughly 570,000 bots are distributed globally, with about half
located in the following countries, in order of prevalence: India,
Indonesia, Vietnam, Turkey and Iran.
-- Necurs uses a domain generation algorithm (DGA) to obfuscate its
operations and avoid takedown. However, DGA is a double-edged sword:
because the DGA domains Necurs will use are known in advance, security
researchers can use methods like sinkholing DGA domains and analyzing
DNS and network traffic to enumerate bots and command and control (C2)
infrastructure.
-- CenturyLink took steps to mitigate the risk of Necurs to customers, in
addition to notifying other network owners of potentially infected
devices to help protect the internet.
Additional Resources


-- Discover how TheMoon has evolved into a proxy as a service:
http://news.centurylink.com/2019-01-31-TheMoon-Illustrates-Evolving-Thre
at-of-IoT-Botnets
[https://c212.net/c/link/?t=0&l=en&o=2385509-1&h=1915957721&u=http%3A%2F
%2Fnews.centurylink.com%2F2019-01-31-TheMoon-Illustrates-Evolving-Threat
-of-IoT-Botnets&a=http%3A%2F%2Fnews.centurylink.com%2F2019-01-31-TheMoon
-Illustrates-Evolving-Threat-of-IoT-Botnets].
-- Learn more about Mylobot's second stage attack:
http://news.centurylink.com/2018-11-14-Mylobot-botnet-delivers-one-two-p
unch-with-Khalesi-malware
[https://c212.net/c/link/?t=0&l=en&o=2385509-1&h=1107942408&u=http%3A%2F
%2Fnews.centurylink.com%2F2018-11-14-Mylobot-botnet-delivers-one-two-pun
ch-with-Khalesi-malware&a=http%3A%2F%2Fnews.centurylink.com%2F2018-11-14
-Mylobot-botnet-delivers-one-two-punch-with-Khalesi-malware].
-- Find out how the Satori botnet is resurfacing with new targets:
http://news.centurylink.com/2018-10-29-Satori-botnet-resurfaces-with-new
-targets
[https://c212.net/c/link/?t=0&l=en&o=2385509-1&h=2439297575&u=http%3A%2F
%2Fnews.centurylink.com%2F2018-10-29-Satori-botnet-resurfaces-with-new-t
argets&a=http%3A%2F%2Fnews.centurylink.com%2F2018-10-29-Satori-botnet-re
surfaces-with-new-targets].
About CenturyLink
CenturyLink [https://c212.net/c/link/?t=0&l=en&o=2385509-1&h=890385521&u=http%3A%2F%2Fwww.centurylink.com%2F&a=CenturyLink] is the second largest U.S. communications provider to global enterprise customers. With customers in more than 60 countries and an intense focus on the customer experience, CenturyLink strives to be the world's best networking company by solving customers' increased demand for reliable and secure connections. The company also serves as its customers' trusted partner, helping them manage increased network and IT complexity and providing managed network and cyber security solutions that help protect their business.

https://mma.prnewswire.com/media/134213/centurylink_logo.jpg [https://mma.prnewswire.com/media/134213/centurylink_logo.jpg]

Logo - https://mma.prnewswire.com/media/134213/centurylink_logo.jpg [https://c212.net/c/link/?t=0&l=en&o=2385509-1&h=3678797939&u=https%3A%2F%2Fmma.prnewswire.com%2Fmedia%2F134213%2Fcenturylink_logo.jpg&a=https%3A%2F%2Fmma.prnewswire.com%2Fmedia%2F134213%2Fcenturylink_logo.jpg]

CONTACT: Stephanie Walkenshaw, +1 720-888-3084, stephanie.walkenshaw@centurylink.com

Web site: http://www.centurylink.com/

PR Newswire

Dit persbericht is via ANP Pers Support naar internationale (vak en online) media gestuurd. Heb je nieuws voor buitenlandse journalisten? Bekijk dan onze mogelijkheden of neem contact met ons op.

Verstuur nu éénmalig een persbericht

Verstuur persberichten en beeldmateriaal naar redacties in binnen- en buitenland. Via het ANP-net, het internationale medianetwerk van PR Newswire of met een perslijst op maat.

Direct persbericht versturen
070 - 41 41 234