Pierluigi Paganini
May 03, 2024
Trend Micro researchers reported that the EdgeRouter botnet, called Moobot, used by the APT28 group is still active and is also used by cyber criminal organizations.
In January, the Federal Bureau of Investigation (FBI), National Security Agency (NSA), US Cyber Command, and international partners released a joint Cybersecurity Advisory (CSA) to warn that Russia-linked threat actors are using compromised Ubiquiti EdgeRouters to evade detection in cyber operations worldwide.
The US agencies and international partners (peers from Belgium, Brazil, France, Germany, Latvia, Lithuania, Norway, Poland, South Korea, and the United Kingdom) observed multiple Russia-linked threat actors (the Russian General Staff Main Intelligence Directorate (GRU), 85th Main Special Service Center (GTsSS), also known as APT28, Fancy Bear, and Forest Blizzard (Strontium)) using the Moobot botnet.
The threat actors used the botnet harvest credentials, collect NTLMv2 digests, proxy network traffic, and host spear-phishing landing pages and custom tools.
The Moobot botnet has been active since at least 2016, it also includes other routers and virtual private servers (VPS). After FBI took down the botnet, the operators set up a new C2 infrastructure to control the compromised systems. Multiple bots were still infected even after the takedown operated by law enforcement.
Trend Micro also discovered that at least two prominent cybercriminal groups and the Russia-linked APT group Pawn Storm used the botnet.
The researchers observed hundreds of Ubiquiti EdgeRouter routers being used for different purposes, including Secure Shell (SSH) brute forcing, pharmaceutical spam, employing server message block (SMB) reflectors in NTLMv2 hash relay attacks, proxying stolen credentials on phishing sites, multi-purpose proxying, cryptocurrency mining, and sending spear phishing e-mails.
“We attribute the NTLMv2 hash relay attacks and the proxying of credential phishing to Pawn Storm, while the pharmaceutical spam looks to be related to the infamous Canadian Pharmacy gang.” reported Trend Micro. “Apart from the EdgeRouter devices, we also found compromised Raspberry Pi and other internet-facing devices in the botnet. Moreover, we found more than 350 datacenter VPS IP addresses that were still compromised even after the FBI disruption. Many of these compromised servers previously called back to the old C&C and later called back to the new C&C infrastructure. These could be easily abused by Pawn Storm or any other threat actor, as the criminal botnet operator protects their stolen assets poorly.”
During the investigation into a Linux botnet targeted in a partial takedown by the FBI in January 2024, the researchers discovered another Linux botnet running on some of the same EdgeRouters previously exploited by Pawn Storm.
This second botnet exhibits greater discretion and improved operational security, as the associated malware operates exclusively in memory, leaving no malicious files on the disk. The analysis of memory dumps and command-and-control connections revealed that the botnet is running a variant of the Ngioweb malware. Evidence suggests that these bots are part of a residential botnet available for commercial use to subscribers. The discovery underscores significant interest among different threat actors in compromising internet-facing routers.
The following table shows simultaneous activity found by Trend Micro on compromised EdgeRouters.
| Intrusion set | Motivation | TTP | TTP | Time range |
|---|---|---|---|---|
| Pawn Storm | Espionage | Shell scripts, SSH tunneling | Credential Phishing, NTLMv2 hash relay attack | April 2022 – April 2024 |
| Water Zmeu | Financial gain | Shell scripts, SSHDoor | Proxy service, Data theft, Scanning, Cryptocurrency mining | 2016 – 2024 |
| Water Barghest | Financial gain | Reverse proxy, Multilayered C&C infrastructure | Residential proxy service | 2018-2024 |
“Internet-facing devices like SOHO routers are also a popular asset for criminal purposes and espionage.” concludes the report. “In the specific case of the compromised Ubiquiti EdgeRouters, we observed that a botnet operator has been installing backdoored SSH servers and a suite of scripts on the compromised devices for years without much attention from the security industry, allowing persistent access. Another threat actor installed the Ngioweb malware that runs only in memory to add the bots to a commercially available residential proxy botnet. Pawn Storm most likely easily brute forced the credentials of the backdoored SSH servers and thus gained access to a pool of EdgeRouter devices they could abuse for various purposes.”
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, APT28)
