FBI foiled plan to create Russian botnet on thousands of devices

U.S. FBI personnel repelled an attack by Russian hackers on thousands of routers and firewalls that were to be networked into a botnet to flood third-party servers with fraudulent traffic. Reuters reports.

The botnet was controlled by malware known as Cyclops Blink. In late February, U.S. and U.K. cyberdefence agencies publicly attributed it to the Sandworm hacker group, believed to be linked to Russia’s military intelligence service.

Cyclops Blink is designed to seize control of devices manufactured by WatchGuard Technologies Inc and ASUSTeK Computer Inc. It provides access to compromised systems, allowing remote exfiltration or deletion of data, and to configure devices to act against third parties.

WatchGuard confirmed cooperation with the U.S. Department of Justice in dismantling the botnet, but did not disclose how many devices were affected, saying only that it represented “less than 1% of WatchGuard devices.”

According to the FBI, thousands of enterprises worldwide were affected by the attack.

U.S. authorities urged WatchGuard device owners to take steps “to remove viruses and vulnerabilities,” though patches had been applied to fewer than half of them.

Separately, Microsoft thwarted attempts by hackers linked to Russia’s GRU to breach servers in Ukraine.

The cyberattack was directed at “Ukrainian organizations, including the media.” The firm said the hackers sought to establish long-term access to the systems, provide tactical support for Russia’s invasion of Ukraine, and seize confidential information.

Recall that, in late March, media reported that hackers obtained Apple and Meta user data.

Follow ForkLog’s Bitcoin news on our Telegram — cryptocurrency news, prices and analysis.