The US government on Wednesday announced a major takedown of a botnet full of end-of-life Cisco and Netgear routers after researchers warned it was being used by Chinese state-backed hackers as a covert communications channel.
The disruption comes less than two months after researchers at Lumen Technologies linked the hijacked routers to Volt Typhoon, a known Chinese APT previously caught targeting US critical infrastructure.
Volt Typhoon, flagged by Microsoft and US government officials as a Chinese hacking group with the ability to disrupt critical infrastructure, has burrowed deep into thousands of organizations spanning communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and the education sectors.
According to the Justice Department, a court-authorized operation cleared the way for the FBI to remotely seize control of hundreds of infected routers and send instructions to delete malware and change settings used for malware communications.
The FBI used the botnet's own command-and-control communication mechanism to remotely delete the KV Botnet malware from the routers and took additional steps to sever their connection to the botnet, such as blocking communications with other devices used to control the botnet.
The government released court documents to show how it extensively tested the operation on relevant Cisco and NetGear routers to avoid impacting the legitimate functions of, or collect content information from, hacked routers.
The FBI said it is notifying all owners or operators of SOHO routers that were remotely accessed in the takedown operation.
Last December, researchers warned that the router botnet was packed with outdated Cisco, Netgear and Fortinet devices acting as a Tor-like covert data transfer network to perform malicious operations.
In an interview with SecurityWeek, Black Lotus Labs researcher Danny Adamitis said KV Botner features a complex infection process and a well concealed command-and-control framework.
Adamitis said botnet is made up primarily of end-of-life products that are vulnerable to critical security issues.
Vendors have stopped shipping security patches for these devices, meaning they will remain unpatched.
This Cyber News was published on www.securityweek.com. Publication date: Wed, 31 Jan 2024 21:13:04 +0000