DOJ quietly eliminated Russian malware from routers in US houses and companies

Enlarge (credit score: Getty Pictures)

Greater than 1,000 Ubiquiti routers in houses and small companies had been contaminated with malware utilized by Russian-backed brokers to coordinate them right into a botnet for crime and spy operations, in keeping with the Justice Division.

That malware, which labored as a botnet for the Russian hacking group Fancy Bear, was eliminated in January 2024 below a secret court docket order as a part of “Operation Dying Ember,” in keeping with the FBI’s director. It affected routers working Ubiquiti’s EdgeOS, however solely people who had not modified their default administrative password. Entry to the routers allowed the hacking group to “conceal and in any other case allow quite a lot of crimes,” the DOJ claims, together with spearphishing and credential harvesting within the US and overseas.

In contrast to earlier assaults by Fancy Bear—that the DOJ ties to GRU Army Unit 26165, which is often known as APT 28, Sofacy Group, and Sednit, amongst different monikers—the Ubiquiti intrusion relied on a recognized malware, Moobot. As soon as contaminated by “Non-GRU cybercriminals,” GRU brokers put in “bespoke scripts and recordsdata” to attach and repurpose the gadgets, in keeping with the DOJ.