In one of the largest mass bricking events in history, at least 600,000 routers belonging to subscribers of the same ISP service were essentially destroyed last October. The incident has been dubbed “Pumpkin Eclipse,” with researchers still unclear on how the routers became infected.
The affected devices displayed a steady red light and were unresponsive to troubleshooting attempts, and had to be replaced. Now new research is shedding light on the attack, which involved unusually sophisticated and stealthy attack methods.
‘Pumpkin Eclipse’ Router Attack
The attack began on October 25, 2023, as the ISP’s subscribers began reporting their ActionTec T3200 and Sagemcom routers had suddenly stopped working. Users described the devices as unresponsive, with a steady red light on the front panel.
Many blamed the ISP for the mass “bricking” of the routers, alleging the company had pushed faulty firmware updates. However, according to new research by Black Lotus Labs, the incident was in fact the result of a deliberate, malicious act.
The researchers reported that over a 72-hour period, a malware known as “Chalubo” had infected over 600,000 routers connected to a single autonomous system number (ASN) belonging to an unnamed ISP. While the researchers avoided naming the ISP affected in the attack, the description of the attack matches frustrations expressed months ago by subscribers of the Windstream ISP, such as the router affected and its resulting behavior.
The Chalubo malware, a commodity remote access trojan (RAT) first identified in 2018, employed sophisticated tactics to cover its tracks. It removed all files from the infected devices’ disks, ran entirely in memory, and assumed random process names already present on the routers.
The researchers believe the malware downloaded and ran code that permanently overwrote the router’s default device firmware, rendering them permanently inoperable. The researchers state that while the motives behind the attack are unknown, its implications are troubling.
Researchers Unsure Over Initial Attack but Offer Recommendations
Although the researchers identified the malware’s multi-chain attack process and its spread across the ISP’s network, they have been unable to determine the initial infection vector employed by the threat actor. They theorize that it could have possibly resulted from the exploit of an inherent vulnerability, exploit of weak credentials, or compromise of the routers’ administrative panels.
The researchers said the attack is highly concerning, as it represents a new precedent for malware capable of mass-bricking consumer networking devices. The researchers could only recall one prior similar event – the 2022 discovery of the AcidRain malware, which knocked out over 10,000 satellite internet modems in Ukraine and Europe during the start of the Russian invasion.
The researchers said the impact of “Pumpkin Eclipse” attack was particularly severe, as the affected ISP’s service area covers many rural and underserved communities. Residents may have lost access to emergency services, farmers could have been cut off from remote crop monitoring, and healthcare providers may have been unable to access patient records or provide telehealth services.
“At this time, we do not assess this to be the work of a nation-state or state-sponsored entity,” the Lumen researchers wrote. In fact, we have not observed any overlap with known destructive activity clusters; particularly those prone to destructive events such as Volt Typhoon, or SeaShell Blizzard.
Nonetheless, they speculated that usage of a commodity malware family may have been a deliberate move to obscure the perpetrator’s potential identity.
Recovery from such a supply chain disruption is always more challenging in isolated or vulnerable regions, the researchers added.
Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.