‘Silent zombie’ bot armies slip under radar, warns report

Bots are going undetected in company systems for an average of nearly four months, and can be purchased on the deep web for as little as 70 cents each, according to fresh data released by specialist firm Netacea.

“Bots are going undiscovered for an average of 16 weeks, up two weeks from last year’s findings,” said the bot detection company, which surveyed 440 businesses across the travel, entertainment, ecommerce, financial, and telecoms sectors in the US and UK.

“On the face of it, this looks like a very poor result for businesses hoping to fight the effect of bot attacks. Our research has shown that bots have a substantial effect on business revenues,” said Andy Still, Netacea cofounder, adding that 97% of companies reported dissatisfied customers as a direct result.

Six in ten businesses had detected bot attacks on their application programming interface – software used in messaging that allows one device to talk to another – while 39% had spotted similar attacks on mobile phone apps, up from 46% and 23% last year respectively.

Netacea said that the rising numbers of attacks could be interpreted as being due to greater awareness among organizations, resulting in more being spotted than in 2021.

“We see at least part of this increase in bot attacks being down to a greater awareness,” it said. “Businesses are getting better and recognising bot attacks, and so while it may look like things are getting worse, there is some cause for cheer.”

However, it pointed to the increased detection time as evidence that companies still have a way to go before they can be said to be tackling the problem comprehensively. “The most damning result of our research shows the risk of complacency – bots can essentially run wild for months before the threat is tackled. Better understanding is vital, but just the first step.”

Market-driven crime

The invitation-only deep web forum Genesis Market is the go-to spot for cybercriminals looking to purchase bots – which in large numbers amount to a digital ‘zombie’ army of hijacked computers that can then be marshaled against targets in mass denial-of-service attacks – and prices are set according to the amount of data on a commandeered device.

Netacea found a staggering 350,000 bots for sale, representing a like number of machines that have been infected by malicious coding so they can be used to facilitate cyberattacks.

“The tasks that Genesis Market bots undertake is the large-scale infection of consumer devices to steal their fingerprints, cookies, saved logins, and autofill form data,” said Netacea, adding that the “data is packaged up and put for sale.”

“Bots can be purchased for as little as 70 cents and upwards of $370 for bots with significant amounts of data on them,” said Netacea, adding that each sale usually also contains data on the browsers used by a victim machine, as well as device country of origin and operating system.

“To access the browser into which the data may be loaded, a purchase must be made on the store,” said Netacea. “Purchases are made by loading a wallet with Bitcoin and then choosing a bot to buy. Once bought, the buyer has exclusive access to the data including any updates that may come as the device remains infected.”

Such purchases then allow the cybercriminal customer to impersonate the victim’s device online, using saved logins to infiltrate their accounts, “all without any access to the original device.”

Busting the bot myths

One positive drawn from the Netacea report appears to be the decline of “bot myths” – with fewer companies believing such attacks are only generated by adversary nations such as Russia and China. Just half of firms surveyed clung to this and other misconceptions, such as that ReCAPTCHA systems and firewalls are guaranteed defenses against bot attacks.

“Businesses may be beginning to turn the tide – but if so it really is just the beginning,” said report contributor Matthew McMinn, head of threat research at Netacea.