Analyzing Adversary Botnets for Offensive Cyber Operations

The talk examines the "neutral web": routers, network storage, smart TVs and VPN appliances that belong to neither attacker nor victim but get taken over as stepping stones. It starts with classic botnets such as Mirai, mostly used to rent out denial-of-service capacity for extortion, then moves to state-linked cases. These include disruption campaigns against Estonia and Georgia in 2007 and 2008, a 2012 wave against US banks, and Ukraine-related activity. Such operations were largely disruptive rather than destructive, and their origin was hard to pin down.

The middle section covers newer proxy networks, often called operational relay box networks. Instead of one layer of compromised devices, they add several hops between controller and victim, hiding where traffic starts and keeping command channels resilient. The speaker cites VPNFilter and Cyclops Blink, linked to GRU-associated actors, and China-linked KV botnet activity tied to Volt Typhoon. Takedowns often fail or are followed by rebuilding, and blocking single addresses does little against rotating nodes.

The closing part weighs responses: enforcing multi-factor authentication, patching edge devices, tracking infrastructure as a shifting network, and disrupting controllers. Each option raises legal, ethical and jurisdictional questions, especially when it would mean acting on devices owned by unrelated people abroad. The speaker argues for cross-border cooperation and for device owners to keep exposed equipment patched.