Navigating Geopolitical Nuances in Cyberattacks With Advanced IP Address Analysis

The talk examines how attackers reach exposed Windows Remote Desktop servers and whether their real origin can be inferred from IP addresses alone. The researchers ran a cloud-hosted honeynet of RDP servers for several years, capturing brute-force login attempts before compromise and recording attacker sessions afterward. Their starting point is that offender behavior is linked to where offenders operate, but proxies, VPNs and compromised machines blur that link.

To judge proxy use, the team queried several IP reputation services and compared their flags against a ground-truth set. That set was built from mismatches between external and internal addresses and time zones seen in successful intrusions. On a three-month subset, the results showed that the services disagreed widely: one was highly precise but flagged few addresses, while another flagged many and was often wrong. Proxy users tended to route through infrastructure close to themselves, some password habits clustered by country, and attack intensity varied widely even within a single country.

The speakers stressed limits. Compromised intermediate machines can hide the true source, and some services appeared to hold stale or polluted data. Their practical takeaway is that reputation feeds should be treated with caution, especially when attributing activity to a country. Similar tooling and strategies appearing across countries may hint at shared infrastructure, though the evidence they presented is limited. Their next step is to study the kinds of crime carried out inside compromised sessions.