Actions Target Russian Govt. Botnet, Hydra Dark Market
Summary: The FBI disrupted Cyclops Blink, a botnet of compromised ASUS and WatchGuard firewalls and routers built by hackers working with Russia's GRU, by obtaining court orders to remove the malware from its command-and-control servers rather than disinfecting infected devices. Separately, German authorities seized the server infrastructure of Hydra, a darknet market operating since 2015 with roughly 17 million customers and 19,000 vendors and at least 1.23 billion euros in sales in 2020 alone, while the U.S. Treasury sanctioned Hydra- and Garantex-linked wallets. The DOJ said the GRU built Cyclops Blink by exploiting previously undocumented weaknesses in ASUS and WatchGuard equipment, and experts attribute both Cyclops Blink and its predecessor VPNFilter to Sandworm, the group blamed for disrupting Ukraine's electricity in 2015.
Why it matters: Treasury said roughly 86 percent of the illicit Bitcoin received directly by Russian virtual currency exchanges in 2019 came from Hydra, including about $8 million in ransomware proceeds laundered for groups such as Ryuk and Conti - the same infrastructure that monetizes intrusions against your network.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026