Insights on using a Cloud Telescope to observe internet-wide botnet propagation activity

No ratings

Presented at BSidesLV 2024 by

Fabricio Bortoluzzi

This presentation introduces the Cloud Telescope: a reproducible and ephemeral cloud-native architecture for globally distributed capture of cybernetic activity. The Cloud Telescope comprises a Terraform infrastructure-as-code architecture currently compatible with Amazon Web Services in their twenty-six commercially available regions. We present the Cloud Telescope’s architecture alongside with the results from three experiments conducted in 2023. For experiment number 2, we were able to describe Mirai infection patterns, the commands that are executed upon infection and the most active countries providing infrastructure for botnet payload propagation.