FBI’s Urgent Request: Reboot Your Router to Stop Russia-Linked Malware
Posted May 27, 2018 11:54 a.m. EDT
Hoping to thwart a sophisticated malware system linked to Russia that has infected hundreds of thousands of internet routers, the FBI has made an urgent request to anybody with one of the devices: Turn it off, and then turn it back on.
The malware is capable of blocking web traffic, collecting information that passes through home and office routers and disabling the devices entirely, the bureau announced Friday.
A global network of hundreds of thousands of routers is already under the control of the Sofacy Group, the Justice Department said last week. That group, which is also known as APT 28 and Fancy Bear and believed to be directed by Russia’s military intelligence agency, hacked the Democratic National Committee before the 2016 presidential election, according to U.S. and European intelligence agencies.
The FBI has several recommendations for any owner of a small office or home office router. The simplest thing to do is reboot the device, which will temporarily disrupt the malware if it is present. Users are also advised to upgrade the devices’ firmware and to select a new secure password. If any remote-management settings are in place, the FBI suggests disabling them.
An analysis by Talos, the threat intelligence division for the tech giant Cisco, estimated that at least 500,000 routers in at least 54 countries had been infected by the malware, which the FBI and cybersecurity researchers are calling VPNFilter. Among the affected networking equipment it found during its research were devices from manufacturers including Linksys, MikroTik, Netgear and TP-Link.
To disrupt the Sofacy network, the Justice Department sought and received permission to seize the web domain toknowall.com, which it said was a critical part of the malware’s “command-and-control infrastructure.” Now that the domain is under FBI control, any attempts by the malware to reinfect a compromised router will be bounced to an FBI server that can record the IP address of the affected device.
“This court-ordered seizure will assist in the identification of victim devices and disrupts the ability of these hackers to steal personal and other sensitive information and carry out disruptive cyberattacks,” Scott W. Brady, U.S. attorney for the Western District of Pennsylvania, said in the statement.
The analysis by Talos noted significant similarities between VPNFilter’s computer code and “versions of the BlackEnergy malware — which was responsible for multiple large-scale attacks that targeted devices in Ukraine.”
In Talos’ assessment, the threats posed by VPNFilter extend far beyond the personal problems created by stolen passwords: Under the right circumstances, an attack could have a global reach.
“The malware has a destructive capability that can render an infected device unusable,” it said, “which can be triggered on individual victim machines or en masse, and has the potential of cutting off internet access for hundreds of thousands of victims worldwide.”