Understanding Infrastructure Laundering: Cybercriminals Exploit AWS and Azure

Cybercriminals never sleep, and as the cybersecurity landscape evolves, so do their methods. They've upped their game yet again by infiltrating some of the world’s most reputable cloud service providers—specifically Amazon Web Services (AWS) and Microsoft Azure—for what researchers are now calling "infrastructure laundering." If this term is new to you, buckle up because this phenomenon is as insidious as it is ingenious.
The article delves into groundbreaking research by the cybersecurity firm Silent Push, which outlines how hackers exploit major cloud platforms for illegal purposes. Let’s explore what infrastructure laundering involves, how it works, and why this modern-day cyber sleight-of-hand raises serious questions about cloud security.

---

What Is "Infrastructure Laundering"?​

Imagine laundering money, but instead of cash, you’re legitimizing malicious web operations. This is the essence of “infrastructure laundering,” a term introduced by Silent Push researchers to describe a cunning cyber tactic.
Here’s how it works:

• Cybercriminals rent IP addresses from trusted cloud services like AWS and Azure.
• These IP addresses are mapped to criminal websites using third-party content delivery networks (CDNs) such as FUNNULL.
• The role of FUNNULL? It’s a known bad actor, suspected to be connected to organized crime syndicates. Despite ongoing takedown efforts, FUNNULL manages over 200,000 questionable domains—many linked to phishing, scams, and even money laundering operations.

Using stolen identities or fraudulent credentials, these cyber masterminds acquire new IPs almost as quickly as companies like Amazon or Microsoft can revoke the old ones. It’s like a game of Whack-A-Mole, except the stakes for global cybersecurity have never been higher.

---

How Hackers Exploit Cloud Platforms​

Step 1: Renting from Trustworthy Platforms​

Hackers intentionally target reputable platforms—AWS and Microsoft Azure are household names in cloud computing. By embedding themselves in these tech giants’ environments, cybercriminals gain a veneer of legitimacy. Security systems often hesitate to block traffic coming from trusted providers, which is precisely what hackers bank on.

Step 2: CNAME Mapping Chains​

A key tactic hackers use is CNAME mapping chains. Here’s how it works:

• CNAME (Canonical Name) records are used in DNS systems to alias one domain name to another.
• FUNNULL orchestrates intricate chains that link these criminal domains to multiple IPs across regions worldwide.

This decentralization makes the infrastructure much harder to track and disrupt. It allows malicious actors to flip their operations to new IPs with remarkable agility, leaving behind a trail of frustrated cybersecurity teams.

Step 3: Globally Distributed Infrastructure​

By leveraging CDNs like FUNNULL, the hackers create a global network of servers optimized for speed and reliability. This setup guarantees worldwide, fast access to their criminal websites (think phishing pages or scam sites), all without being easily identifiable as malicious. The cherry on top? Illicit activity is effectively hidden under the guise of cloud providers’ legitimate offerings.

---

The Unique Threat of Infrastructure Laundering​

To understand why this method is so effective, we need to compare it to the more traditional model of bulletproof hosting, a term you may have heard before. Bulletproof hosting involves setting up malicious servers in lightly regulated jurisdictions that turn a blind eye. Think of countries with lax cybercrime laws or few enforcement resources.
Infrastructure laundering flips this approach on its head:

• Instead of dodging regulations, hackers deflect attention by exploiting trusted providers.
• These efforts make it far harder to detect and disrupt their activities without inadvertently impacting the legitimate websites hosted by the same providers.
• The speed of operations guarantees hackers can stay one step ahead.

It’s the security equivalent of hiding a wolf in sheep’s clothing, and it’s alarmingly sophisticated.

---

Why Is FUNNULL a Major Player?​

FUNNULL, the CDN at the center of this malicious web, serves as the primary operational nexus. Silent Push’s research highlights some shocking metrics:

• Over 1,200 IP addresses rented from AWS.
• Nearly 200 IP addresses sourced from Microsoft Azure.
• More than 200,000 domains hosted, many dynamically altered using Domain Generation Algorithms (DGAs).

These figures underscore a significant gap in the detection and monitoring capabilities of both AWS and Azure. For context, domain generation algorithms randomize and frequently cycle through domain names, adding an extra layer of operational chaos and obfuscation.

---

Cloud Providers’ Enforcement Challenges​

AWS and Azure’s Dilemma​

Both Amazon and Microsoft are clearly aware of the issue, yet their responses have been reactive rather than proactive. Amazon has publicly denied any complicity but acknowledges the financial damage caused by these exploits. While the company is investing in detection capabilities, experts argue that these efforts fall short of what’s required to address a problem of this scale.

Why Real-Time Detection is Critical​

Silent Push emphasizes the need for real-time systems capable of shutting down fraudulent IP usage instantly. Current approaches allow hackers a significant operational window, giving them enough time to wreak havoc before their activities are flagged.
The challenges don’t stop there:

• Collateral Damage: Shutting down malicious IPs without impacting legitimate users hosted on the same cloud platform is a tightrope walk.
• Silver-Tongued Intermediaries: Third-party intermediaries like FUNNULL act as shadow brokers, further muddying the waters and making enforcement exponentially harder.

---

Implications for Cybersecurity and Regulation​

This infrastructure laundering scheme should send shivers down the spines of both IT teams and policymakers alike. A few critical questions arise:

• Can cloud providers like AWS and Azure be held partially accountable for the repeated misuse of their platforms?
• Should governments regulate CDNs more closely to prevent their abuse as cybercrime hubs?
• How can international collaboration tackle not just cyber actors but also their cross-border infrastructure?

The line between cybercrime and traditional organized crime is blurring. This isn't just about phishing campaigns—it’s often about large-scale, transnational operations involving fraud, scams, and money laundering.

---

What Should You Do as a Windows User or IT Manager?​

If you’re running a Windows environment, you don’t need AWS or Azure to be compromised directly to feel the ripple effects of such attacks. Here are some practical steps:

• Boost End-User Awareness: Phishing attacks are one of the primary tools here. Educating users about suspicious links and emails can prevent many incidents.
• Harden Perimeter Defenses: Utilize modern endpoint detection and response (EDR) tools—many built into Windows environments—to block malicious connections.
• Leverage DNS Filtering: Many enterprise tools now allow you to monitor and block DNS requests to suspicious domains. This can stymie attempts to connect to criminal infrastructure like FUNNULL-hosted sites.
• Cloud Usage Scrutiny: If your company uses AWS, Azure, or other major cloud providers, implement auditing to ensure legitimate network activities.

---

Final Thoughts​

The evolving sophistication of cyber threats shows no signs of slowing down. Infrastructure laundering, particularly through AWS and Microsoft Azure, is a wake-up call for anyone who relies on cloud services. As Silent Push’s report demonstrates, it’s not enough for providers to react—they need to evolve their defenses in real time.
For now, the onus is also on users, IT admins, and industry regulators to double down on detection and prevention. Hackers may innovate, but so can defenders.
What do you think? Are cloud providers doing enough to combat cybercrime, or is it time for governments to step in? Share your thoughts and tips below in the WindowsForum.com community!

---

Source: GBHackers News https://gbhackers.com/hackers-exploit-aws-microsoft-azure/