The United States FBI has seized control of thousands of routers and firewall appliances from Russian military hackers by hijacking the same infrastructure that Moscow’s spies were using to interact with the devices, according to U.S. authorities on Wednesday.
The extraordinary procedure was characterized in an unsealed redacted affidavit as a pre-emptive attempt to prevent Russian hackers from mobilizing the hijacked machines into a “botnet” — a network of hacked computers that can assault other systems with rogue traffic.
“Fortunately, we were able to disrupt this botnet before it could be used,” U.S. Attorney General Merrick Garland said.
The Russian Embassy in Washington did not respond to an email requesting a comment right away.
The targeted botnet was controlled through malware called Cyclops Blink, which U.S. and UK cyber defense agencies had publicly attributed in late February to “Sandworm,” allegedly one of the Russian military intelligence service’s hacking teams that have repeatedly been accused of carrying out cyberattacks.
Cyclops Blink was designed to hijack devices made by WatchGuard Technologies Inc and ASUSTeK Computer Inc, according to research by private cybersecurity firms.
It provides Russian services with access to those compromised systems, offering the ability to remotely exfiltrate or delete data or turn the devices against a third party.
Watchguard issued a statement confirming it worked with the U.S. Justice Department to disrupt the botnet but did not disclose the number of devices affected – saying only that they represented “less than 1 percent of WatchGuard appliances.”
FBI Director Chris Wray told reporters the FBI, with court approval, secretly reached into thousands of routers and firewall appliances to delete the malware and reconfigure the devices.
“We removed malware from devices used by thousands of mostly small businesses for network security all over the world,” Wray said. “We shut the door the Russians had used to get into them.”
The affidavit noted that U.S. officials launched an awareness campaign “to inform owners of WatchGuard devices of the steps they should take to remediate infections or vulnerabilities” and yet less than half the devices had been fixed to expel the hackers.
The affidavit noted that the FBI had carried out its work in cooperation with WatchGuard.
The announcement came amid a flurry of new sanctions announced against Russian banks and elites, days after grim images emerged of the bodies of civilians shot at close range in the town of Bucha. read more
Russia says its “special military operation” is aimed at demilitarising and “denazifying” Ukraine, and it has denied targeting civilians.
Discussion about this post