Experts spoke about cyberattacks targeting Russian infrastructure

Russia ranks second in the number of cyberattacks targeting it, while the United States ranks first, according to data from Solar 4RAYS, the Solar Group's cyberthreat research center, which were reviewed by Izvestia on December 6. Canada, Switzerland and Singapore are also among the most attacked countries.

According to experts, in the third quarter of this year, Russia accounted for 28% of triggers recorded by the network of sensors and hanipots, while the United States recorded 37% of all triggers.

According to experts, the global network of sensors and hanipots is a multitude of servers with one of the samples of popular software (software). The traps mimic various equipment and systems, from routers and surveillance cameras to industrial software. Fraudsters do not know that they have attacked the emulation and begin to develop the attack.

Keeping an eye out: How Russians are being attacked by stalking programs

In 2024, 25% more people will face such surveillance

As specified in "Solar", the top countries from whose IP-addresses cyberattacks were observed in Q3 was headed by India (31%). Next came Lithuania (24%), China (22%) and the United States (8%). A year ago, China (31%) was the leader.

"Most likely, this distribution is due to the fact that the countries where the most attacks come from have a prevalence of certain software and hardware that can be easily hacked by attackers to create botnets. For example, there are a lot of externally accessible servers, routers with unpatched vulnerabilities, etc.," the cyber research center analyst explained - Ilya Ayupov, an analyst at Solar 4RAYS, Solar's cyber threat research center, explained.

According to him, another possible reason is the popularity of virtual private servers (VPS) in these countries. Attackers can rent them to anonymize their attacks.

Most often, cybercriminals tried to hack into trap infrastructures using bruteforce, a password brute-force method. The share of such attacks amounted to 71%. A year ago, bruteforce accounted for 93% of attacks.

Earlier, on November 17, Evgeny Pankov, project manager of the .RU/.RF Coordination Center, told Izvestia that there is a steady increase in phishing attacks conducted via messengers, especially Telegram and WhatsApp (owned by Meta, which is banned in Russia). According to him, 2,374 domains imitating Telegram were blocked in Runet in the first 10 months of this year, which is 2.2 times higher than the same period last year. For the second messenger, the number of blocked domains increased more than five times - from 205 to 1,036.