/>
X

This sophisticated malware is targeting routers to break into networks

ZuoRAT router malware took advantage of the shift to remote work.
liam-tung.jpg
Written by Liam Tung, Contributing Writer on
wireless-router-hand.jpg
Image: Shutterstock

A newly discovered remote access trojan (RAT) called ZuoRAT has targeted remote workers by exploiting flaws in often unpatched small office/home office (SOHO) routers. 

Researchers at Lumen's Black Lotus Labs threat intelligence unit report that ZuoRAT is part of a highly targeted, sophisticated campaign that has been targeting workers across North America and Europe for nearly two years, beginning in October 2020. 

"The tactics, techniques and procedures (TTPs) that analysts observed are highly sophisticated and bear the markings of what is likely a nation-state threat actor," Lumen said.

SEE: Ransomware attacks: This is the data that cyber criminals really want to steal

Lumen explains that, when the pandemic sent workers home in March 2020, threat actors were given a fresh opportunity to target SOHO routers -- or edge network devices -- that are rarely monitored or patched by corporate network admins and which fall outside traditional network perimeters. 

The firm believes the malware's capabilities suggest it was the work of a highly sophisticated actor. 

These capabilities included: "gaining access to SOHO devices of different makes and models, collecting host and LAN information to inform targeting, sampling and hijacking network communications to gain potentially persistent access to in-land devices and intentionally stealth C2 infrastructure leveraging multistage siloed router to router communications."

Lumen concedes it only has a narrow view of the actor's broader capabilities but its researchers assess with "high confidence" that the elements it is tracking are part of a broader campaign. 

Also, Lumen estimates this campaign has impacted at least 80 targets, but it says likely many more have been affected.

Black Lotus Labs notes that it observed telemetry indicating infections stemming from numerous SOHO router manufacturers, including ASUS, Cisco, DrayTek and Netgear.  

Elements of the campaign the researchers have gleaned to date include the ZuoRAT for SOHO routers, a loader for Windows compiled in C++, and three agents that allow device enumeration, downloading and uploading files, network (DNS/HTTP) communication hijacking, and process injection. 

The three agents included:

  • CBeacon – A custom developed RAT written in C++, which had the ability to upload and download files, run arbitrary commands and persist on the infected machine via a component object model (COM) hijacking method.
  • GoBeacon – A custom-developed RAT written in Go. This trojan had almost the same functionality as CBeacon, but also allowed for cross-compiling on Linux and MacOS devices.
  • Cobalt Strike – In some cases, this readily available remote access framework was used in lieu of either CBeacon or GoBeacon.    

"Router malware campaigns pose a grave threat to organizations because routers exist outside of the conventional security perimeter and can often have weaknesses that make compromise relatively simple to achieve," said Mark Dehus, director of threat intelligence for Lumen Black Lotus Labs. 

"Organizations should keep a close watch on SOHO devices and look for any signs of activity outlined in this research. This level of sophistication leads us to believe this campaign might not be limited to the small number of victims observed. To help mitigate the threat, they should ensure patch planning includes routers, and confirm these devices are running the latest software available." 

Related

Mobile app development bootcamps: There's a bootcamp for that
replace-this-image.jpg

Mobile app development bootcamps: There's a bootcamp for that

Bootcamps
FBI, CISA warn over ransomware gang that can make million dollar demands
the-hands-of-a-computer-hacker-over-a-keyboard.jpg

FBI, CISA warn over ransomware gang that can make million dollar demands

Security
Hiring developers? This is how many interviews it takes to fill a job
developers-security

Hiring developers? This is how many interviews it takes to fill a job

Professional Development