The U.S. government announced that it has disrupted a botnet consisting of small office and home office (SOHO) routers that was being used by the Russia-linked APT28 group to conceal their malicious activities. APT28, also known as BlueDelta, Fancy Bear, and other names, has been active since 2007. The attackers used MooBot, a Mirai-based botnet that targeted Ubiquiti routers, to carry out their cyber espionage campaigns. MooBot exploited vulnerabilities in the routers and implanted SSH malware to gain remote access. The botnet allowed the threat actors to mask their location, steal credentials, and propagate the malware. The FBI identified compromised Ubiquiti routers through public scans and leveraged spear-phishing campaigns to obtain login credentials. In an operation called Dying Ember, the U.S. government issued commands to disrupt the botnet and prevent further crime. The exact number of compromised devices in the U.S. has not been disclosed, but infected Ubiquiti routers have been found in almost every state. This operation follows recent efforts by the U.S. to dismantle hacking campaigns originating from China and Russia.
Source link
