Security News TheMoon malware infects 6,000 ASUS routers in 72 hours for proxy service

[vtqhtr413]

Content source

https://www.bleepingcomputer.com/news/security/themoon-malware-infects-6-000-asus-routers-in-72-hours-for-proxy-service/

A new variant of "TheMoon" malware botnet has been spotted infecting thousands of outdated small office and home office (SOHO) routers and IoT devices in 88 countries.

TheMoon is linked to the "Faceless" proxy service, which uses some of the infected devices as proxies to route traffic for cybercriminals who wish to anonymize their malicious activities.

Black Lotus Labs researchers monitoring the latest TheMoon campaign, which started in early March 2024, have observed 6,000 ASUS routers being targeted in under 72 hours.

The threat analysts report that malware operations such as the IcedID and SolarMarker currently use the proxy botnet to obfuscate their online activity.

TheMoon malware infects 6,000 ASUS routers in 72 hours for proxy service

A new variant of "TheMoon" malware botnet has been spotted infecting thousands of outdated small office and home office (SOHO) routers and IoT devices in 88 countries.

www.bleepingcomputer.com

 

[Practical Response]

TheMoon malware infects 6,000 ASUS routers in 72 hours for proxy service

A new variant of "TheMoon" malware botnet has been spotted infecting thousands of outdated small office and home office (SOHO) routers and IoT devices in 88 countries.

www.bleepingcomputer.com

Keyword here is "outdated". Unpatched routers not kept up to speed with firmware updates.

 

[oldschool]

Keyword here is "outdated". Unpatched routers not kept up to speed with firmware updates.

I see "outdated" here means EOL devices.

The researchers do not specify the exact method used to breach the ASUS routers, but given that the targeted device models are end-of-life, it is likely that the attackers leveraged known vulnerabilities in the firmware.

 

[Practical Response]

I see "outdated" here means EOL devices.

End of life is unpatched either way. Not supported or maintained, either way, vulnerable from lack of due diligence.

 

[Jonny Quest]

Thanks @vtqhtr413 for posting this timely thread, as I just bought a new Asus router on Amazon yesterday and that was one of the things I considered, if it was still a new enough model to be supported with firmware updates, which it is. Thanks also for the affirming follow-up replies, Practical Response and oldschool