Some network guys at my work seem to think that a client that we monitor may be part of a botnet, but the spike in traffic that we see at night always stops at the latest around 8am in time for office workers coming in.

Before bothering the customer I'd like to know if botnet nodes are known at all to stop working as part of a botnet during office hours. Is this kind of thing known to happen at all?

  • 3
    If they want to be stealthy, they do. – schroeder Nov 29 '18 at 9:25
  • Network spikes at night...any chance it is an Offsite backup? – DarkMatter Nov 29 '18 at 14:36
  • there is a regular backup, the only question is whether the botnet opts to work at the same time, which judging by the answers on here, may well be the case. – LBC Nov 29 '18 at 14:41
  • Can you get a packet capture to find out? – DarkMatter Nov 29 '18 at 14:48
  • do you mean PRTG / something similar? I have PRTG for the customers network. the network seems to be doing a bit more work but that could be because there is more to back up in the past month. its difficult to tell. – LBC Nov 29 '18 at 14:51

Botnets and malware, especially sophisticated ones, are made to be as stealthy as a malware could be. The fact that the piece of malware you're talking about "stops working" during office hours makes me suspect a data exfiltration bot more than a general-purpose zombie.

The first example of malware that comes to me is Lazarus/Bluenoroff, it specialised in financial cyber attacks, and where attackers operated out of office hours according to the victim's schedule and timezone to avoid detection.

  • 1
    Can you clarify what you mean by "PC-zombie" in relation to data exfiltration (I was on the team that coined the phrase "zombie")? Also, while I agree in general with your concepts, data exfiltration is more stealthy during office hours when users are sending data out as normal business operations. You configure the malware to work out of hours when the activity being performed would be noticed by the user (like high resource consumption). And your document said that the attackers worked out of hours, not the malware. The document clearly states that it operated while the user was working. – schroeder Nov 29 '18 at 13:25
  • @schroeder well I'm really happy to have the discussion with you if you was on that team :) what I meant is being compromised in order to perform unwanted tasks (from DDoS to data exfiltration) is being a "zombie", the thing is that as far as i'm concerned no "traditional" botnet was seen checking for work hours (but it depends on the definition you give to botnet). Now the document said attackers worked out of hours => Attackers used both passive and active backdoors. The passive backdoors was just listening for commands that comes out of work hours. – Soufiane Tahiri Nov 29 '18 at 15:05
  • 1
    The bot does not have to check hours - all it needs to do is to check for inactivity. It's the same effect but easier to code (and more adaptive to user behaviour). And that's quite common. – schroeder Nov 29 '18 at 15:10
  • The context of the attack is important. You're right but being on inactive machine doesn't mean guys on SOC are inactive too, hence the need to check for work hours and potentially time zone. – Soufiane Tahiri Nov 29 '18 at 15:15

Depends on the botnet, but is a nice capability of the botnet, on this way the infected nodes of the botnet could potentially pass unnoticed for infected users. The same effect was happening with cryptominers.

Take into account that the work of a Security/Administrator is to check the logs of firewalls, machines and so on, so they should be able to detect this type of activity even is out of office hours.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.