{"id":47371,"date":"2022-06-29T11:33:06","date_gmt":"2022-06-29T11:33:06","guid":{"rendered":"http:\/\/a2a378cf-1532-4448-aeef-c47027f98259"},"modified":"2022-06-29T11:33:06","modified_gmt":"2022-06-29T11:33:06","slug":"this-sophisticated-malware-is-targeting-routers-to-break-into-networks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/this-sophisticated-malware-is-targeting-routers-to-break-into-networks\/","title":{"rendered":"This sophisticated malware is targeting routers to break into networks"},"content":{"rendered":"
\n
\n
\"wireless-router-hand.jpg\"<\/picture><\/div>\n

<\/div>\n

Image: Shutterstock<\/span><\/figcaption><\/figure>\n

A newly discovered remote access trojan (RAT) called ZuoRAT has targeted remote workers by exploiting flaws in often unpatched small office\/home office (SOHO) routers. <\/p>\n

Researchers at Lumen’s Black Lotus Labs threat intelligence unit report that ZuoRAT is part of a highly targeted, sophisticated campaign that has been targeting workers across North America and Europe for nearly two years, beginning in October 2020. <\/p>\n

\n

ZDNet Recommends <\/h3>\n<\/p><\/div>\n

“The tactics, techniques and procedures (TTPs) that analysts observed are highly sophisticated and bear the markings of what is likely a nation-state threat actor,” Lumen said<\/a>.<\/p>\n

SEE: <\/strong>Ransomware attacks: This is the data that cyber criminals really want to steal<\/strong><\/a><\/p>\n

Lumen explains that, when the pandemic sent workers home in March 2020, threat actors were given a fresh opportunity to target SOHO routers — or edge network devices — that are rarely monitored or patched by corporate network admins and which fall outside traditional network perimeters. <\/p>\n

The firm believes the malware’s capabilities suggest it was the work of a highly sophisticated actor. <\/p>\n

These capabilities included: “gaining access to SOHO devices of different makes and models, collecting host and LAN information to inform targeting, sampling and hijacking network communications to gain potentially persistent access to in-land devices and intentionally stealth C2 infrastructure leveraging multistage siloed router to router communications.”<\/p>\n

Lumen concedes it only has a narrow view of the actor’s broader capabilities but its researchers assess with “high confidence” that the elements it is tracking are part of a broader campaign. <\/p>\n

Also, Lumen estimates this campaign has impacted at least 80 targets, but it says likely many more have been affected.<\/p>\n

Black Lotus Labs notes that it observed telemetry indicating infections stemming from numerous SOHO router manufacturers, including ASUS, Cisco, DrayTek and Netgear.  <\/p>\n

Elements of the campaign the researchers have gleaned to date include the ZuoRAT for SOHO routers, a loader for Windows compiled in C++, and three agents that allow device enumeration, downloading and uploading files, network (DNS\/HTTP) communication hijacking, and process injection. <\/p>\n

The three agents included:<\/p>\n