InfoSecBulletin Cybersecurity for mankind
The FBI has observed a type of malware named AVrecon, which was used to target many network devices around the world. The malware has a flexible design, allowing new attack tools to be added when new weaknesses are found.
This increases the number of devices it can infect. The FBI found about 1,200 targeted device types from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
AVrecon can change infected devices into proxy nodes. It can also update its saved settings, connect to a server controlled by an attacker, and download and run different programs on the device.
Once a router gets infected, the malware sends signals to its command and control server every 60 seconds using a PING/PONG method. When the server has instructions, it stops the loop and tells the infected router to open a traffic tunnel to a SocksEscort relay server.
The Persistence Problem
The way AVrecon stays on some devices makes fixing them hard. Attackers use the device’s firmware update feature to put in a special firmware that has AVrecon. This stops the device from getting future updates or changes.
The FBI notes these devices are essentially permanently infected — a factory reset cannot help if the reset itself has been disabled, and an end-of-life device has no manufacturer patches to address the underlying vulnerability regardless.
What SocksEscort Built and Sold
SocksEscort ran an illegal service that let customers hide their internet activity using hacked home and small-office routers in 163 countries, including the United States. They used a tunneling method called SOCKS, which is a real networking standard that sends traffic through another computer. In this illegal way, it made the attacker look like they were using the victim’s home IP address instead of a place that could be blocked or traced.
FBI thinks SocksEscort has taken and sold access to about 369,000 devices since 2020. The malware that made this happen is called AVrecon. It was made using the C programming language and is meant to attack devices that use MIPS and ARM processors, which are common in consumer routers.
What the Proxy Network Enabled
The FBI and partners saw that SocksEscort used its system for ad fraud, trying to exploit website weaknesses, password attacks, digital market fraud, bank fraud, and romance fraud, among other bad acts. By using home IP addresses for attacks, SocksEscort customers greatly improved their chances of getting past corporate security checks and lists that block traffic from well-known commercial or cloud service providers.
Remediation for Network Defenders
FBI says to update the firmware on all home routers and IoT devices now. Many devices do not update by themselves and need you to do it through their settings. If a device is End-of-Life and doesn’t get security updates anymore, you should replace it completely.
Remote admin features should be turned off or limited with firewall rules, and all default passwords need to be changed.
Network defenders should monitor for traffic to the C2 domains and IP addresses published in the advisory and watch for the malware filenames “x” (loader) and “dnssmasq” (malware) on network-connected devices.
