Forest Global Training Partners

Cyber Risks · Cisco Talos

In the Eye of the Hailstorm

Summary: Cisco Talos and Umbrella describe "hailstorm" spam, an evolution of snowshoe spam that sends very high volumes from many IP addresses over a short timespan, sometimes ending around the time the fastest traditional anti-spam defenses can update. In one example, DNS query volume for a hailstorm domain spiked to over 75,000 queries per hour from near zero, versus a maximum of 35 queries per hour for a snowshoe domain, and a sample of about 500 hailstorm-related domains most commonly used the .top, .bid, .us, .win and .stream TLDs.

Why it matters: A campaign that spikes to over 75,000 queries per hour and stops before defenses update leaves reputation and volume-based anti-spam systems with little time to react. Talos also found that among 475 hailstorm domains averaging 9,332 peak queries per hour, significantly more mail servers targeted were inside the USA than the rest of the world.

Read the original at Cisco Talos ↗

Topics
Malware
Related