Russian Business Network study - bizeul.org

Version 1.0.1
RBN study – before and after
David Bizeul
9. The RBN Networks in the Internet
Now it’s time to understand why people get infected because of RBN activities.
Several pieces of the big puzzle have been resolved. When you place all of them in the correct order you get something
like that:
1 – All malicious codes are diffused through different ISPs relating to RBN such as Nevacon or Akimon.
2 – Those malicious ISPs are linked to SBT-Tel which aims at spreading them as far as possible.
3 – It seems there is a hook in Silvernet in order to give SPB-IX connectivity to SBT-Tel networks. Silvernet has also a
peering relation with ReTN.
4 – SPB-IX is directly connected to the biggest IXP in Russia: MSK-IX. Both of them are under the liability of RIPN.
5 –ISP backbones offer the ability to connect IXPs such as MSK-IX. ReTN is connected to several IXPs [ 26 ], LINX is
also one of them.
6 – SBT-Tel can establish peering relations with some big ISP on interesting Internet Exchange Points.
7 – Credulous victims can now become infected easily because all RBN Networks are broadcasted everywhere in the
world.
As this study is being written, ReTN is connected on LINX, DE-CIX, AMS-IX, FICIX and NetNod and that’s why those
IXP have been indicated as possible spreading points for RBN.
On ReTN website [ 27 ], we can see a complete network map which displays multiple points of presence.
26
https://www.euro-ix.net/member/m/peeringmatrix ReTN ASN is associated with Peterstar
20