Trickbot uses compromised MikroTik routers as C2 communication proxies
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-14847 | Directory Traversal in MikroTik RouterOS Winbox Interface (Unauthenticated File Read) CVE-2018-14847 is a directory traversal (CWE-22) vulnerability in the Winbox interface of MikroTik RouterOS through version 6.42. An unauthenticated remote attacker can send crafted Winbox requests that traverse directories to read arbitrary files on the device, while authenticated attackers can also write arbitrary files. By reading files an attacker can retrieve sensitive device data such as stored credentials or configuration, and file write capability can support further compromise of the router. Any MikroTik router or device running RouterOS at or below 6.42 with the Winbox interface reachable is affected, which includes large numbers of internet-exposed edge and ISP devices. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities catalog (added 2021-12-01), has multiple public PoCs, and compromised MikroTik routers have been used by threats such as Trickbot (as C2 proxies) and the Mēris botnet, with public scans reporting over 300,000 vulnerable devices. Do: Apply MikroTik's updates per vendor instructions, moving RouterOS above version 6.42, prioritizing devices with Winbox reachable from untrusted networks. Until patched, restrict or disable Winbox access from WAN/untrusted interfaces to limit unauthenticated file reads. Given known botnet abuse of this flaw, check devices for signs of compromise and rotate credentials that may have been exposed via file reads. | 9.1 | 96% | KEV PoC ×7 |
| mass≈300,000+ internet-exposed MikroTik devices |
Full article330 words · extracted from helpnetsecurity.com · click to collapse
MikroTik routers are getting compromised to serve as communication proxies for Trickbot malware, to enable Trickbot-affected devices to communicate with their their C2 server in a way that standard network defense systems won’t detect, Microsoft researchers have found.
MikroTik routers under attack
Trickbot is a modular trojan that’s been around since 2016 and is often used by cybercriminals to deliver ransomware or other malware.
Previous attempts to cripple the Trickbot botnet have been just partly successful, so the botnet lives on. Its controllers are also constantly trying new tricks to allow the malware to persist on infected systems and keep communication with C2 servers uninterrupted.
Their latest trick is to gain control over MikroTik routers – either by trying out default passwords, launching brute-force attacks (with unique passwords that were likely harvested from other MikroTik devices), or exploiting CVE-2018-14847 – and keep it by changing the affected device’s password.
The compromised routers are then used to create a line of communication between the Trickbot-infected device and the Trickbot C2 servers: the routers receive traffic from Trickbot-infected device via port 449, redirect it to port 80, and send it from that port to the command and control server.
Detection and remediation
Having your MikroTik routers compromised just to serve as communication proxies might seem like a much lesser problem than them being hijacked for cryptojacking, for intercepting traffic and serving malicious sites and ads, or to participate in DDoS attacks.
Nevertheless, consumers and organizations should keep in mind that a switch to any of those can be made by attackers at any moment.
To help (tech-savvy) users and organizations discover whether their MicroTik devices have been compromised, Microsoft researchers have released an open-source forensic tool that allows them to search for suspicious properties and weak security points that need to be fixed on the router.
They have also delineated some detection and remediation steps organizations can take to clean-up infected devices and steps they can take to prevent future infections.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/03/17/trickbot-uses-compromised-mikrotik-routers-as-c2-communication-proxies/