The FBI took down a botnet of small office/home office (SOHO) routers used by Russia’s Main Intelligence Directorate of the General Staff (GRU) in spearphishing and credential theft attacks targeting the United States and its allies.
This network of hundreds of Ubiquiti Edge OS routers infected with Moobot malware was controlled by GRU Military Unit 26165, also tracked as APT28, Fancy Bear, and Sednit.
The Russian hackers’ targets include U.S. and foreign governments, military entities, and security and corporate organizations.
“This botnet was distinct from prior GRU and Russian Federal Security Service (FSB) malware networks disrupted by the Department in that the GRU did not create it from scratch. Instead, the GRU relied on the ‘Moobot’ malware, which is associated with a known criminal group,” the Justice Department said.
Cybercriminals not linked with the GRU (Russian Military Intelligence) first infiltrated Ubiquiti Edge OS routers and deployed the Moobot malware, targeting Internet-exposed devices with widely known default administrator passwords.
Subsequently, the GRU hackers leveraged the Moobot malware to deploy their own custom malicious tools, effectively repurposing the botnet into a cyber espionage tool with global reach.
FBI wipes malware and blocks remote access
During a court-authorized operation, FBI agents remotely accessed the compromised routers and used the Moobot malware itself to delete stolen and malicious data and files.
Next, they deleted the Moobot malware and blocked remote access that would’ve otherwise allowed the Russian cyberspies to reinfect the devices.
“Additionally, in order to neutralize the GRU’s access to the routers until victims can mitigate the compromise and reassert full control, the operation reversibly modified the routers’ firewall rules to block remote management access to the devices, and during the course of the operation, enabled temporary collection of non-content routing information that would expose GRU attempts to thwart the operation,” the Justice Department said.
Besides thwarting GRU’s access to the routers, the operation did not disrupt the devices’ standard functionality or harvest user data. Moreover, the court-sanctioned actions that severed the routers’ link to the Moobot botnet are only temporary.
Users can reverse the FBI’s firewall rules by factory resetting their routers or accessing them through the local networks. However, factory resetting the devices without changing the default admin password will expose them to reinfection.
Who is APT28?
The APT28 cyber-espionage group was previously linked to the 2015 hack of the German Federal Parliament (Deutscher Bundestag).
They were also behind attacks against the Democratic Congressional Campaign Committee (DCCC) and the Democratic National Committee (DNC) in 2016 (for which they were charged in the U.S. two years later).
The Council of the European Union also sanctioned multiple APT28 members in October 2020 for their involvement in the 2015 German Federal Parliament hack.
Moobot is the second botnet used by state-sponsored hackers to evade detection disrupted by the FBI in 2024 after the takedown of the KV-botnet used by Chinese Volt Typhoon state hackers in January.
Since then, CISA and the FBI also issued guidance for SOHO router manufacturers, urging them to secure their devices against ongoing attacks with the help of secure configuration defaults and eliminating web management interface flaws during development.