{"id":45770,"date":"2022-03-17T20:51:28","date_gmt":"2022-03-17T20:51:28","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/has-trickbot-gang-hijacked-your-router-this-scanner-may-have-an-answer\/"},"modified":"2022-03-17T20:51:28","modified_gmt":"2022-03-17T20:51:28","slug":"has-trickbot-gang-hijacked-your-router-this-scanner-may-have-an-answer","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/has-trickbot-gang-hijacked-your-router-this-scanner-may-have-an-answer\/","title":{"rendered":"Has Trickbot gang hijacked your router? This scanner may have an answer"},"content":{"rendered":"

Microsoft has published a tool that scans for and detects MikroTik-powered Internet-of-Things devices that have been hijacked by the Trickbot gang.<\/p>\n

The open-source scanner<\/a> comes after an investigation by Redmond’s Defender for IoT research team into how the nefarious malware crew takes over MikroTik routers and sets them up to funnel communications to and from Trickbot-infected computers on the network and the criminals’ backend servers.<\/p>\n

In a release note<\/a> this week, Microsoft’s security team outlined how miscreants compromise the MikroTik devices to strengthen Trickbot’s C2 communications. The gang first must acquire credentials for the gateways, and according to Microsoft it does this through a variety of methods including using default MikroTik passwords and launching brute force attacks.<\/p>\n