Cyber-Espionage Groups Are Increasingly Leveraging Routers in Their Attacks

[Faybert]

Content source

https://www.bleepingcomputer.com/news/security/cyber-espionage-groups-are-increasingly-leveraging-routers-in-their-attacks/

Cyber-espionage groups —also referred to as advanced persistent threats (APTs)— are using hacked routers more and more during their attacks, according to researchers at Kaspersky Lab.

"It's not necessarily something new. Not something that just exploded," said Costin Raiu, director of Global Research and Analysis Team (GReAT) at Kaspersky Lab, in a webinar today.

"We've seen a bunch of router attack throughout the years. A very good example is SYNful Knock, a malicious implant for Cisco [routers] that was discovered by FireEye but also threat actors such as Regin and CloudAtlas. Both APTs have been known to have and own proprietary router implants."
The number of APTs using router hacks has increased
But the number of APTs leveraging routers for attacks has gone steadily up in the past year, and the tactic has become quite widespread in 2018.

For example, the Slingshot APT (believed to be a US Army JSOC operation targeting ISIS militants) has used hacked MikroTik routers to infect victims with malware.

Similarly, the Inception Framework APT, another nation-state-backed cyber-espionage operation, hacked home routers and built a network of proxies it could hide behind using an attack known as UPnProxy.
..........
..........

Raiu: A lot of things happening in the background
LuckyMouse is a new APT. There is no public report detailing the LuckyMouse APT's activity, but this is one of the few cases where researchers have managed to link router hacks to a cyber-espionage group's operations. More incidents still need to be investigated, such as the mysterious case of synchronized router reboots.

"One thing interesting in Q1 [2018], we've seen a Govcert advisory on unusual reboots for a prominent router brand. In some cases, these reboots were taking place at the pretty much the same minute across multiple devices deployed in infrastructures, suggesting that it's somehow coordinated," Raiu said today.
........
........