FBI disrupts Moobot botnet used by Russian military hackers
FBI disrupts Moobot botnet used by Russian military hackers
www.bleepingcomputer.com
US disrupts Russian hacking campaign that infiltrated home, small business routers: DOJ
15 comments
-
-
This article gives no details, but here's a relevant bit from another article:
Cybercriminals not linked with the GRU (Russian Military Intelligence) first infiltrated Ubiquiti Edge OS routers and deployed the Moobot malware, targeting Internet-exposed devices with widely known default administrator passwords.
Subsequently, the GRU hackers leveraged the Moobot malware to deploy their own custom malicious tools, effectively repurposing the botnet into a cyber espionage tool with global reach.
[...]
"Additionally, in order to neutralize the GRU's access to the routers until victims can mitigate the compromise and reassert full control, the operation reversibly modified the routers' firewall rules to block remote management access to the devices, and during the course of the operation, enabled temporary collection of non-content routing information that would expose GRU attempts to thwart the operation," the Justice Department said.
And here is the press release:
-
Based on this article it sounds like as long as you don’t have open ports for remote administration open and/or if you’ve changed the default admin password you SHOULD be ok? I’m curious to see what recommendations Ubiquiti has regarding this.
-
That's what the released information information suggests, yes. (Edit: Assuming you took those precautions before the original attack, of course.)
-
-
Thank you. I've updated the post to your link.
-
15 comments
Any idea which routers were vulnerable to this? Article didn’t seem to specify.
I answered this in my top-level comment. (And agreed: the article originally posted is useless. OP has since changed the link to the one I found.)
Right on, thank you!
Check for a DOJ press release it'll probably have more details.