CenturyLink sounds the alarm about TheMoon botnet, a versatile tool for fraud

New research is a reminder of how versatile the hordes of infected computers can be in catering to hackers’ needs.

Botnets have been a staple of malicious cyber activity for years because they can be cheap and facilitate cyberattacks at scale. Now, new research highlights how versatile hordes of infected computers can be in catering to hackers’ needs, from advertisement fraud to brute-force attacks.

Researchers at communications provider CenturyLink said Thursday they spent a year tracking a botnet dubbed TheMoon, which can be repurposed by hackers for a range of malicious services.

CenturyLink’s team found an iteration of TheMoon that uses infected microprocessor-based devices as proxy servers that can be sold to other attackers. In one case, researchers said they watched a video-ad fraudster use a proxy service to send requests to 19,000 different URLs from one server in the span of six hours. The ease with which TheMoon enables fraud should have companies on alert.

“We have reason to believe the botnet actor has sold this proxy botnet as a service to other malicious actors and has used it for credential brute forcing, video advertisement fraud, general traffic obfuscation and more,” CenturyLink Threat Research Labs said in a blog post.

“TheMoon has the ability to run any additional payload, making it particularly dangerous and allowing the botnet author to evolve its capabilities over time,” the research states.

The botnet exploits known vulnerabilities in broadband routers and modems made by companies including Linksys and D-Link.

TheMoon attracted researchers’ attention when devices under its spell carried out brute-force attacks on multiple unnamed websites. CenturyLink Threat Research Labs analysts worked backward from there, using the IP addresses of compromised devices to identify other infrastructure used by TheMoon.

CenturyLink said it has blocked the botnet’s infrastructure on the company’s network to mitigate the risk to customers, and that it has alerted third parties to the threat. The impact of TheMoon seems to be waning, the researchers said, with a sharp drop in IPs pinging the botnet’s command-and-control communication network in recent months.

“Though it appears the impact of TheMoon botnet is decreasing, the threat of IoT botnets with varying capabilities remains a powerful one,” the researchers wrote. “The likelihood of this actor attempting to infect new devices in the future by adding additional exploits to the existing toolkit is high.”

U.S. officials have been warning that internet of things (IoT) devices are a boon for botnets. A report published in May by the Department of Commerce concluded that manufacturers of IoT equipment are largely driven by cost and not security concerns, exacerbating the botnet problem.

TheMoon botnet feeds off of such vulnerable IoT gear; its author scans for hosts running insecure devices and then sends a shell script to the target using one of a catalogue of exploits.

The research comes a day after the cybersecurity industry was reminded of the persistence, and potential potency, of botnets. On Wednesday, the Justice Department announced an operation to disrupt the North Korea-linked Joanap botnet, which has been preying on unpatched devices for the last decade.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure