Forest Global Training Partners

Cyber Risks · Krebs on Security

Crooks Use Hacked Routers to Aid Cyberheists

Summary: Researchers at Fujitsu's Security Operations Center in Warrington, UK tracked Upatre being served from hundreds of compromised home routers, particularly those running MikroTik and Ubiquiti's AirOS. Upatre delivers the Dyre banking trojan, which hijacks all three major browsers to intercept online banking sessions and harvest credentials, and Fujitsu's Bryan Campbell said the botnet's consistent communication with compromised routers suggests known firmware vulnerabilities are being exploited.

Key Takeaway: Attackers may simply be logging in with default credentials like 'ubnt' for both username and password on Ubiquiti AirOS routers, and Fujitsu found a disturbing number of botnet systems with the telnet port wide open - the same vector behind the January 2015 attack that briefly knocked Xbox and PlayStation networks offline.

Read the original at Krebs on Security ↗

Topics
Malware
Related