Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Network Scanning Traffic Observed in Public Clouds

Summary: Unit 42 researchers analyzed trillions of Flow Logs collected by Prisma Cloud over a four-month period from May to August 2021 and found an average of 75,000 unique scanner IP addresses globally enumerating more than 9,500 ports each day. Samba, Telnet and SSH were the three most scanned services at 36% of global scanning traffic, 96% of the traffic was TCP, and 64% of scanner IPs appeared only once across the four months while 0.15% appeared daily.

What's compelling: Because 64% of scanner IPs are ephemeral, blocking them is largely futile, and the source notes attackers can discover a newly exposed service in minutes and compromise an insecure or vulnerable one in seconds. The scanning itself is reconnaissance, but the results feed the actors who follow.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related