CP
cyberpings
Malware & RansomwareHIGH

Malware - Feds Disrupt IoT Botnets Behind DDoS Attacks

KoKrebs on Security
DDoSIoTAisuruKimwolfJackSkid
🎯

Basically, the government shut down bad software controlling millions of hacked devices to stop attacks.

Quick Summary

The U.S. Justice Department has disrupted four major IoT botnets responsible for massive DDoS attacks. Over three million devices were compromised, causing significant financial losses for victims. This decisive action aims to prevent future cyber threats and protect vulnerable networks.

What Happened

The U.S. Justice Department, in collaboration with law enforcement from Canada and Germany, has successfully dismantled the infrastructure behind four notorious IoT botnets. These botnets, named Aisuru, Kimwolf, JackSkid, and Mossad, had compromised over three million Internet of Things (IoT) devices, including routers and web cameras. They were responsible for a series of unprecedented DDoS attacks that could take almost any target offline.

The operation involved executing seizure warrants against multiple U.S.-registered domains and virtual servers linked to these botnets. The authorities reported that the individuals controlling these botnets launched hundreds of thousands of attacks, often extorting victims for payments. Some victims faced losses amounting to tens of thousands of dollars due to these attacks.

Who's Being Targeted

The botnets primarily targeted IoT devices, which are often less secure and easier to exploit. The Aisuru botnet was particularly aggressive, issuing over 200,000 attack commands. Other botnets like JackSkid and Kimwolf also contributed significantly to the attacks, with JackSkid launching at least 90,000 and Kimwolf over 25,000 commands. The Mossad botnet, while less active, still accounted for around 1,000 attacks.

These botnets exploited vulnerabilities in IoT devices, which often lack robust security measures. The Kimwolf botnet introduced a novel spreading mechanism that allowed it to infect devices behind internal network protections, making it particularly dangerous.

Tactics & Techniques

The tactics employed by these botnets included a mix of traditional DDoS strategies and innovative methods to spread infections. For instance, Aisuru was used to seed Kimwolf, which then utilized advanced techniques to propagate itself more effectively. This included targeting devices hidden behind firewalls, which typically offer some level of protection.

The Department of Justice (DOJ) noted that the disruption of these botnets was crucial in preventing further infections and limiting their ability to launch future attacks. The operation was supported by nearly two dozen technology companies, showcasing a collaborative effort to combat cybercrime.

Defensive Measures

To protect against such threats, users of IoT devices should take proactive measures. This includes regularly updating device firmware, changing default passwords, and employing network security measures like firewalls. Consumers should also be aware of the risks associated with connecting IoT devices to their networks.

As the landscape of IoT security evolves, vigilance is key. The DOJ's actions serve as a reminder of the ongoing battle against cyber threats and the importance of collaborative law enforcement efforts across borders. Keeping devices secure is not just a personal responsibility; it is a collective effort to safeguard the digital landscape.

🔒 Pro insight: The dismantling of these botnets highlights the need for improved IoT security standards to mitigate similar threats in the future.

Original article from

Krebs on Security · BrianKrebs

Read Full Article

Share

Related Pings

HIGHMalware & Ransomware

Malware - US Takes Down Major Botnets Behind Attacks

The US has successfully dismantled four major botnets, including Aisuru and Kimwolf, that infected over 3 million devices. This takedown is crucial for internet security, as these botnets were behind record DDoS attacks. Ongoing collaboration with international partners aims to combat cybercriminals effectively.

Wired Security·
HIGHMalware & Ransomware

OpenWebUI Servers - Extensive Cryptomining Campaign Uncovered

OpenWebUI servers are being exploited for cryptomining and data theft. Nearly 12,000 servers are at risk due to a critical vulnerability. Organizations must act quickly to secure their systems.

SC Media·
CRITICALMalware & Ransomware

Interlock Ransomware - Exploiting Cisco FMC Zero-Day Flaw

Interlock ransomware is actively exploiting a critical Cisco FMC vulnerability before its public disclosure. Organizations using this software are at high risk. Immediate patching is essential to protect against these attacks.

SC Media·
HIGHMalware & Ransomware

Malware - New .NET AOT Malware Evades Detection with Scoring

A new malware campaign using .NET AOT techniques has been discovered. It targets users through phishing emails and evades detection by evaluating system criteria. This poses serious risks to personal and organizational security. Stay informed and protect your systems.

SC Media·
HIGHMalware & Ransomware

Malware - Android Devices Ship with Keenadu Firmware Threat

Keenadu malware is found in Android firmware, allowing attackers to control devices for ad fraud. Affected models include low-cost Android phones. Users should update firmware and monitor for unusual activity.

Sophos News·
HIGHMalware & Ransomware

Malware - Android Devices Ship with Firmware-Level Threat

A new firmware-level malware called Keenadu is affecting Android devices. Over 500 devices across 40 countries are compromised, enabling ad fraud. Users should update their firmware to mitigate risks.

Sophos News·