FBI disrupts Russian Moobot botnet infecting Ubiquiti routers

The FBI took down a botnet of small office/home office (SOHO) routers used by Russia's Main Intelligence Directorate of the General Staff (GRU) to proxy malicious traffic and to target the United States and its allies in spearphishing and credential theft attacks.

This network of hundreds of Ubiquiti Edge OS routers infected with Moobot malware was controlled by GRU Military Unit 26165, also tracked as APT28, Fancy Bear, and Sednit.

The Russian hackers' targets include U.S. and foreign governments, military entities, and security and corporate organizations.

"This botnet was distinct from prior GRU and Russian Federal Security Service (FSB) malware networks disrupted by the Department in that the GRU did not create it from scratch. Instead, the GRU relied on the 'Moobot' malware, which is associated with a known criminal group," the Justice Department said.

Cybercriminals not linked with the GRU (Russian Military Intelligence) first infiltrated Ubiquiti Edge OS routers and deployed the Moobot malware, targeting Internet-exposed devices with widely known default administrator passwords.

Subsequently, the GRU hackers leveraged the Moobot malware to deploy their own custom malicious tools, effectively repurposing the botnet into a cyber espionage tool with global reach.

On compromised routers, the FBI discovered a wide range of APT28 tools and artifacts, from Python scripts for harvesting webmail credentials and programs for stealing NTLMv2 digests to custom routing rules that redirected phishing traffic to dedicated attack infrastructure.

FBI wipes malware and blocks remote access

As part of court-authorized "Operation Dying Ember,"  FBI agents remotely accessed the compromised routers and used the Moobot malware itself to delete stolen and malicious data and files.

Next, they deleted the Moobot malware and blocked remote access that would've otherwise allowed the Russian cyberspies to reinfect the devices.

"Additionally, in order to neutralize the GRU's access to the routers until victims can mitigate the compromise and reassert full control, the operation reversibly modified the routers' firewall rules to block remote management access to the devices, and during the course of the operation, enabled temporary collection of non-content routing information that would expose GRU attempts to thwart the operation," the Justice Department said.

Besides thwarting GRU's access to the routers, the operation did not disrupt the devices' standard functionality or harvest user data. Moreover, the court-sanctioned actions that severed the routers' link to the Moobot botnet are only temporary.

Users can reverse the FBI's firewall rules by factory resetting their routers or accessing them through the local networks. However, factory resetting the devices without changing the default admin password will expose them to reinfection.

Chinese botnet disruption

Moobot is the second botnet used by state-sponsored hackers to evade detection disrupted by the FBI in 2024 after the takedown of the KV-botnet used by Chinese Volt Typhoon state hackers in January.

Since then, CISA and the FBI also issued guidance for SOHO router manufacturers, urging them to secure their devices against ongoing attacks with the help of secure configuration defaults and eliminating web management interface flaws during development.

The APT28 cyber-espionage group was previously linked to the 2015 hack of the German Federal Parliament (Deutscher Bundestag).

They were also behind attacks against the Democratic Congressional Campaign Committee (DCCC) and the Democratic National Committee (DNC) in 2016 (for which they were charged in the U.S. two years later).

The Council of the European Union also sanctioned multiple APT28 members in October 2020 for their involvement in the 2015 German Federal Parliament hack.