Attackers Without Borders: The South Korean View Of Global Malicious Traffic

Summary: GreyNoise Labs analyzed 30 days of sensor data between mid-September and mid-October 2023 and observed 92,708 malicious exploitation attempts against Korean IP address space and 15,120 attacks originating from Korea against other countries' networks. Of the inbound attempts, 562 (0.6%) were directed only at Korea, and the outbound tag distribution was nearly identical to the inbound, with Mirai botnet activity holding the top spot.
Bottom line: Mobile networks ranked fourth among sources of malicious connection attempts, and blocking them is hard when they carry roughly 40-50% of all benign traffic to most websites and web applications. Korean IP space also carries a higher positive reputation than many countries, so risk-based perimeter trust decisions are more likely to let connections from Korean sources through.

Read the original at GreyNoise Blog ↗