CP
cyberpings
Malware & RansomwareHIGH

Malware - DoJ Disrupts Massive IoT Botnets Behind DDoS Attacks

THThe Hacker News
DDoSIoTbotnetsKimwolfAISURU
🎯

Basically, the government stopped bad guys using millions of hacked devices to attack the internet.

Quick Summary

The DoJ has disrupted major IoT botnets responsible for record DDoS attacks. Over 3 million devices were compromised, impacting global internet infrastructure. This operation highlights the ongoing threat of IoT vulnerabilities.

What Happened

The U.S. Department of Justice (DoJ) recently announced a significant disruption of command-and-control (C2) systems used by several Internet of Things (IoT) botnets, including AISURU, Kimwolf, JackSkid, and Mossad. This operation was part of a court-authorized initiative aimed at combating the rising threat of distributed denial-of-service (DDoS) attacks. Authorities from Canada and Germany collaborated with the DoJ, leveraging the expertise of numerous private sector firms like Akamai and Cloudflare to tackle this issue head-on.

These botnets were notorious for launching record-breaking DDoS attacks, with some reaching an astonishing 31.4 terabits per second. The attacks targeted various victims globally, showcasing the extensive reach and power of these compromised networks. The DoJ stated that these botnets had collectively infected over 3 million devices, primarily consisting of compromised Android devices, digital video recorders, and web cameras.

Who's Being Targeted

The botnets primarily targeted vulnerable IoT devices, which are often less secure than traditional computing systems. The Kimwolf botnet, for instance, was noted for exploiting residential proxy networks, allowing it to infiltrate home networks through compromised devices. This tactic is particularly concerning as it bypasses many conventional security measures, enabling the botnet to manipulate devices that are typically firewalled from external threats.

The scale of these attacks is alarming. For example, the Kimwolf botnet alone is responsible for over 25,000 DDoS attack commands, while AISURU has issued more than 200,000 commands. This indicates a well-organized effort to exploit the vulnerabilities of IoT devices, which are often overlooked in security discussions.

Signs of Infection

Identifying infected devices can be challenging, especially since many of these IoT products lack robust security features. Signs of infection may include unusual network traffic, devices behaving erratically, or unexpected slowdowns in internet speed. Users should be vigilant and monitor their devices for any signs of compromise.

To mitigate risks, it's essential to regularly update device firmware, change default passwords, and disable unnecessary features that could expose devices to the internet. Awareness of these signs can help users take proactive measures to secure their networks against potential threats.

How to Protect Yourself

To safeguard against IoT botnet threats, users should adopt a multi-layered security approach. This includes:

  • Regularly updating firmware on all IoT devices.
  • Changing default passwords to strong, unique passwords.
  • Disabling remote access features unless absolutely necessary.
  • Monitoring network traffic for unusual activity.

Additionally, employing network security solutions that can detect and block suspicious traffic can provide an extra layer of protection. By taking these steps, individuals and organizations can better defend against the growing threat posed by IoT botnets and the DDoS attacks they facilitate.

🔒 Pro insight: The disruption of these botnets marks a critical step in mitigating the DDoS threat landscape, but vigilance is still required.

Original article from

The Hacker News

Read Full Article

Share

Related Pings

HIGHMalware & Ransomware

DDoS Botnets Disrupted - Aisuru and Kimwolf Targeted

An international operation has disrupted major DDoS botnets Aisuru and Kimwolf, impacting over 3 million devices. This highlights the ongoing threat of IoT botnets and the need for robust security measures.

SecurityWeek·
HIGHMalware & Ransomware

Malware - SILENTCONNECT Deploys ScreenConnect via VBScript

SILENTCONNECT malware is stealthily targeting Windows machines, using VBScript and PowerShell to deploy ScreenConnect. This poses a significant risk to corporate security. Organizations must enhance their defenses to combat this sophisticated threat.

Cyber Security News·
HIGHMalware & Ransomware

EDR Killers Explained - Attackers Abuse Vulnerable Drivers

ESET researchers reveal the growing threat of EDR killers in ransomware attacks. These tools disable security measures, making organizations vulnerable. Understanding their operation is crucial for effective defense.

WeLiveSecurity (ESET)·
HIGHMalware & Ransomware

Malware - Feds Disrupt IoT Botnets Behind DDoS Attacks

The U.S. Justice Department has disrupted four major IoT botnets responsible for massive DDoS attacks. Over three million devices were compromised, causing significant financial losses for victims. This decisive action aims to prevent future cyber threats and protect vulnerable networks.

Krebs on Security·
HIGHMalware & Ransomware

Malware - US Takes Down Major Botnets Behind Attacks

The US has successfully dismantled four major botnets, including Aisuru and Kimwolf, that infected over 3 million devices. This takedown is crucial for internet security, as these botnets were behind record DDoS attacks. Ongoing collaboration with international partners aims to combat cybercriminals effectively.

Wired Security·
HIGHMalware & Ransomware

OpenWebUI Servers - Extensive Cryptomining Campaign Uncovered

OpenWebUI servers are being exploited for cryptomining and data theft. Nearly 12,000 servers are at risk due to a critical vulnerability. Organizations must act quickly to secure their systems.

SC Media·