The FBI took down a botnet of small office/home office (SOHO) routers used by Russia's Main Intelligence Directorate of the General Staff (GRU) to proxy malicious traffic and to target the United States and its allies in spearphishing and credential theft attacks.
  • moxEnglish
    10•10 months ago

    This article gives no details, but here’s a relevant bit from another article:

    Cybercriminals not linked with the GRU (Russian Military Intelligence) first infiltrated Ubiquiti Edge OS routers and deployed the Moobot malware, targeting Internet-exposed devices with widely known default administrator passwords.

    Subsequently, the GRU hackers leveraged the Moobot malware to deploy their own custom malicious tools, effectively repurposing the botnet into a cyber espionage tool with global reach.

    […]

    “Additionally, in order to neutralize the GRU’s access to the routers until victims can mitigate the compromise and reassert full control, the operation reversibly modified the routers’ firewall rules to block remote management access to the devices, and during the course of the operation, enabled temporary collection of non-content routing information that would expose GRU attempts to thwart the operation,” the Justice Department said.

    And here is the press release:

    https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian

    • rustydominoEnglish
      6•10 months ago

      Based on this article it sounds like as long as you don’t have open ports for remote administration open and/or if you’ve changed the default admin password you SHOULD be ok? I’m curious to see what recommendations Ubiquiti has regarding this.

      • moxEnglish
        5•10 months ago

        That’s what the released information information suggests, yes. (Edit: Assuming you took those precautions before the original attack, of course.)

    • @WilshireOPEnglish
      2•10 months ago

      Thank you. I’ve updated the post to your link.

    • @AlpacaChariotEnglish
      1•10 months ago

      Makes me glad I replaced the firmware on my Unifi devices with OpenWrt

      • moxEnglish
        1•10 months ago

        OpenWrt has an admin password and UI as well. I hope you changed the former and blocked the latter on external ports, before connecting it to the internet.

        • @agent_flounderEnglish
          2•10 months ago

          Indeed. Pretty sure the latter is blocked by default.

        • @AlpacaChariotEnglish
          2•10 months ago

          Yes of course I changed the root password, I think it would actually be quite difficult not to do that on OpenWrt as it warns you if the password isn’t set.

          Was the exploit not related to unifi’s remote / cloud administration features? That’s how I read it, unless they mean remote admin that was installed by the malware.

          • moxEnglish
            2•10 months ago

            The articles refer to EdgeOS, not UniFi, which is a separate thing.

          • @[email protected]English
            2•10 months ago

            UniFi and Edge are different product lines. UniFi uses a controller (local or cloud-based) and edge products are the more traditional interface on the device itself.

            The article clearly states that edgerouter is the affected product, which means the default password and remote admin interface were the attack vectors.

            • @AlpacaChariotEnglish
              2•10 months ago

              Thanks, I find the names of Ubiquiti’s product lines pretty confusing particularly as they are often used together.

              I have an Edgerouter X, an Edgerouter PoE-5, two UAP-AC-LR (“Ubiquiti UniFi-AC-LR”) access points, and one UAP-AC-MESH (“Ubiquiti UniFi-AC-MESH”) access point.

              The access points came with UniFi firmware, whereas the routers were running EdgeOS. I’m no longer using the PoE-5 and I’ve replaced the firmware on all of the other devices with OpenWrt.