Norway received the most victim traffic across the globe in the first quarter of 2015, followed by: United States, Spain, Sweden, Turkey, Ukraine, China, Pakistan, Poland, and Egypt.
The hardest hit countries – ranked by the absolute number of victims/unique IP addresses conversing with C2s – during the quarter were: China (532,000 unique-victim IP addresses), U.S. (528,000), Norway (213,000), Spain (129,000), and Ukraine (124,000).
From the report: “Norway’s C2 volume was reflective of a C2 hosted within a specific Web hosting environment, which caused a sharp spike in identified C2 traffic. … The high volume of attack traffic in the Netherlands correlates to the victim traffic in Norway and Sweden. Proximity to the target plays a large role in the efficacy of these campaigns.”