{"id":34076,"date":"2020-03-27T16:10:00","date_gmt":"2020-03-27T16:10:00","guid":{"rendered":"https:\/\/www.darkreading.com\/attacks-breaches\/purported-brute-force-attack-aims-at-linksys-routers-as-more-people-work-remotely\/d\/d-id\/1337430"},"modified":"2020-03-27T16:10:00","modified_gmt":"2020-03-27T16:10:00","slug":"purported-brute-force-attack-aims-at-linksys-routers-as-more-people-work-remotely","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/purported-brute-force-attack-aims-at-linksys-routers-as-more-people-work-remotely\/","title":{"rendered":"Purported Brute-Force Attack Aims at Linksys Routers as More People Work Remotely"},"content":{"rendered":"
<\/div>\n
\n<\/header>\n

The attack takes control of poorly secured network devices, redirecting Web addresses to a COVID-themed landing page that attempts to fool victims into downloading malware.<\/span> <\/p>\n

A cybercriminal group has started scanning the Internet for vulnerable Linksys routers in the first stage of an attack that ultimately aims to fool users into downloading and installing malware, security firm Bitdefender stated in an advisory this week.<\/p>\n

The attack first compromises vulnerable routers by purportedly trying weak or default credentials and mainly targeting Linksys routers, the company said. Once an attacker gains access, they hijack DNS functionality, redirecting victims to a page that attempts to convince them to download a malicious, information-stealing program known as Oski. The attacker’s page aims to harness the fear of the coronavirus pandemic to fool victims.<\/p>\n

Bitdefender discovered the attack after several users found their browsing blocked by the company’s program, even though they were trying to visit legitimate sites.<\/p>\n

“The attack is not subtle,” says Liviu Arsene, global cybersecurity research at Bitdefender. “The page does not necessarily look legitimate, but considering that this is an attack that targets home users and home routers, the victims may not have the expertise to figure that out.”<\/p>\n

The attack joins a general rise in malicious activity<\/a> aimed at home users as many of the world’s knowledge workers are sequestered at home in an effort to blunt the spread of the novel coronavirus. About 1,200 users have seemingly downloaded the malware between March 18 and March 23, the company said.<\/p>\n

Multiple security firms have warned that attackers are using coronavirus-themed messages to attempt to lure users into clicking on malicious links. <\/p>\n

“While it’s not uncommon for hackers to piggyback global news, such as the pandemic, to deliver phishing emails laced with tainted attachments, this recent development proves they are nothing if not creative in compromising victims,” Bitdefender stated in a blog post on the attack<\/a>.<\/p>\n

The attackers are focused on the US and European countries, according to the company’s analysis. The US, Germany, and France account for 73% of the targeted routers. <\/p>\n

The attack targets a list of legitimate Web pages and domains, including:<\/p>\n