InfoSecBulletin Cybersecurity for mankind
The FBI has observed a type of malware named AVrecon, which was used to target many network devices around the world. The malware has a flexible design, allowing new attack tools to be added when new weaknesses are found.
This increases the number of devices it can infect. The FBI found about 1,200 targeted device types from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
AVrecon can change infected devices into proxy nodes. It can also update its saved settings, connect to a server controlled by an attacker, and download and run different programs on the device.
Once a router gets infected, the malware sends signals to its command and control server every 60 seconds using a PING/PONG method. When the server has instructions, it stops the loop and tells the infected router to open a traffic tunnel to a SocksEscort relay server.
The Persistence Problem
The way AVrecon stays on some devices makes fixing them hard. Attackers use the device’s firmware update feature to put in a special firmware that has AVrecon. This stops the device from getting future updates or changes.
The FBI notes these devices are essentially permanently infected — a factory reset cannot help if the reset itself has been disabled, and an end-of-life device has no manufacturer patches to address the underlying vulnerability regardless.
What SocksEscort Built and Sold
SocksEscort ran an illegal service that let customers hide their internet activity using hacked home and small-office routers in 163 countries, including the United States. They used a tunneling method called SOCKS, which is a real networking standard that sends traffic through another computer. In this illegal way, it made the attacker look like they were using the victim’s home IP address instead of a place that could be blocked or traced.
FBI thinks SocksEscort has taken and sold access to about 369,000 devices since 2020. The malware that made this happen is called AVrecon. It was made using the C programming language and is meant to attack devices that use MIPS and ARM processors, which are common in consumer routers.
What the Proxy Network Enabled
The FBI and partners saw that SocksEscort used its system for ad fraud, trying to exploit website weaknesses, password attacks, digital market fraud, bank fraud, and romance fraud, among other bad acts. By using home IP addresses for attacks, SocksEscort customers greatly improved their chances of getting past corporate security checks and lists that block traffic from well-known commercial or cloud service providers.
Remediation for Network Defenders
FBI says to update the firmware on all home routers and IoT devices now. Many devices do not update by themselves and need you to do it through their settings. If a device is End-of-Life and doesn’t get security updates anymore, you should replace it completely.
Remote admin features should be turned off or limited with firewall rules, and all default passwords need to be changed.
Network defenders should monitor for traffic to the C2 domains and IP addresses published in the advisory and watch for the malware filenames “x” (loader) and “dnssmasq” (malware) on network-connected devices.
