Attackers Without Borders: The Canadian View of Global Malicious Traffic

Summary: GreyNoise Labs analyzed 30 days of sensor data between mid-August and mid-September 2023 and observed 164,329 malicious exploitation attempts against Canada IP address space and 3,603 attacks originating from Canada against other countries' networks. Of the inbound attempts, 1,564 (1.0%) were directed only at Canada, and the Mirai botnet almost always holds the top tag in that inbound traffic.
Bottom line: Canada IP space carries a higher positive reputation than many other countries, so the risk-based trust decisions in perimeter defenses are more likely to let connections from Canadian sources through - and nodes under adversarial control in Canada appear to be aiming at home and ally networks. GreyNoise notes that leaving a default or misconfigured system on the internet for less than an hour is enough for it to become part of the adversarial inventory.

Read the original at GreyNoise Blog ↗