{"id":55363,"date":"2024-02-15T21:51:46","date_gmt":"2024-02-15T21:51:46","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/feds-dismantle-russian-gru-botnet-built-on-1000-plus-home-small-biz-routers\/"},"modified":"2024-02-15T21:51:46","modified_gmt":"2024-02-15T21:51:46","slug":"feds-dismantle-russian-gru-botnet-built-on-1000-plus-home-small-biz-routers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/feds-dismantle-russian-gru-botnet-built-on-1000-plus-home-small-biz-routers\/","title":{"rendered":"Feds dismantle Russian GRU botnet built on 1,000-plus home, small biz routers"},"content":{"rendered":"

The US government today said it disrupted a botnet that Russia’s GRU military intelligence unit used for phishing expeditions, spying, credential harvesting, and data theft against American and foreign governments and other strategic targets.<\/p>\n

This latest court-authorized takedown happened in January, and involved neutralizing “well over a thousand” home and small business routers that had been infected with the Moobot malware, which is a Mirai variant, according to FBI Director Christopher Wray, speaking at the Munich Cyber Security Conference on Thursday. Moobot can be used to remote-control compromised devices and launch attacks against networks.<\/p>\n

Non-GRU cybercriminals installed Moobot on Ubiquiti Edge OS routers using publicly known default administrator passwords, we’re told. Then the GRU spying team (tracked as APT 28, Forest Blizzard, and Fancy Bear among other names) used Moobot to install their own bespoke scripts and files that repurposed the botnet, thus “turning it into a global cyber espionage platform,” according to the Feds.<\/p>\n

\n

Russian intelligence services turned to criminal groups to help them target home and office routers<\/p>\n<\/blockquote>\n

“Russian intelligence services turned to criminal groups to help them target home and office routers, but the Justice Department disabled their scheme,” opined<\/a> Attorney General Merrick Garland. “We will continue to disrupt and dismantle the Russian government\u2019s malicious cyber tools that endanger the security of the United States and our allies.”<\/p>\n

The botnet targeted organizations that are of interest to the Russian government, including US and foreign governments and military, security, and corporate organizations. In December Microsoft said<\/a> the Fancy Bear crew had been exploiting two previously patched bugs for large-scale phishing campaigns against high-value targets such as government, defense, and aerospace agencies in the US and Europe, though didn’t say if a botnet was used in the attacks.<\/p>\n