An unknown threat actor is targeting routers (opens in new tab) with remote access trojans (RATs), in a bid to hijack traffic, collect sensitive data and compromise connected devices.
This is according to Black Lotus Lab, the threat intelligence division of Lumen Technologies, which recently observed real-world attacks leveraging a novel malware strain, called ZuoRAT.
ZuoRAT is a multi-stage remote access trojan, developed exclusively for SOHO (small office/home office) routers. It’s been in use for some two years now, the researchers say, targeting businesses in North America and Europe.
The malware leverages known vulnerabilities to provide the attackers with access to the routers. Once in, they’re able to deploy two additional, custom-built RATs on the target devices.
The additional RATs allow threat actors to upload and download files, run commands and persist on the workstation. One of them has cross-platform functionality, it was added.
Black Lotus Labs also found two separate command & control (C2) servers. One is designed for the custom workstation RAT, and leverages Chinese third-party services. The second one was designed for the routers.
This malicious campaign started approximately at the same time as the pandemic, and the researchers believe the two are connected. When businesses shifted to remote working, employees began accessing corporate networks from home, increasing the risk factor.
Attackers saw this as an opportunity, trying to leverage home-based devices, such as routers, for their nefarious purposes.
“Router malware campaigns pose a grave threat to organizations because routers exist outside of the conventional security perimeter and can often have weaknesses that make compromise relatively simple to achieve,” said Mark Dehus, Director of Threat Intelligence for Lumen Black Lotus Labs.
“In this campaign, we have observed a threat actor’s capability to exploit SOHO routers, covertly access and modify internet traffic in ways difficult to detect and gain additional footholds in the compromised network.”