Purported Brute-Force Attack Aims at Linksys Routers as More People Work Remotely

A cybercriminal group has started scanning the Internet for vulnerable Linksys routers in the first stage of an attack that ultimately aims to fool users into downloading and installing malware, security firm Bitdefender stated in an advisory this week.

The attack first compromises vulnerable routers by purportedly trying weak or default credentials and mainly targeting Linksys routers, the company said. Once an attacker gains access, they hijack DNS functionality, redirecting victims to a page that attempts to convince them to download a malicious, information-stealing program known as Oski. The attacker's page aims to harness the fear of the coronavirus pandemic to fool victims.

Bitdefender discovered the attack after several users found their browsing blocked by the company's program, even though they were trying to visit legitimate sites.

"The attack is not subtle," says Liviu Arsene, global cybersecurity research at Bitdefender. "The page does not necessarily look legitimate, but considering that this is an attack that targets home users and home routers, the victims may not have the expertise to figure that out."

The attack joins a general rise in malicious activity aimed at home users as many of the world's knowledge workers are sequestered at home in an effort to blunt the spread of the novel coronavirus. About 1,200 users have seemingly downloaded the malware between March 18 and March 23, the company said.

Multiple security firms have warned that attackers are using coronavirus-themed messages to attempt to lure users into clicking on malicious links. 

"While it's not uncommon for hackers to piggyback global news, such as the pandemic, to deliver phishing emails laced with tainted attachments, this recent development proves they are nothing if not creative in compromising victims," Bitdefender stated in a blog post on the attack.

The attackers are focused on the US and European countries, according to the company's analysis. The US, Germany, and France account for 73% of the targeted routers. 

The attack targets a list of legitimate Web pages and domains, including:

When a user attempts to go to one of those domains, the compromised router's settings will send them to an attacker-controlled site claiming to be distributing a COVID information application from the World Health Organization. If the user clicks through to the landing page, they will be download a program from one of four Bitbucket repositories, Bitdefender stated in its analysis.

The program is a downloader that installs Oski, a relatively new Trojan developed in 2019.

"Some of the features that it packs revolve around extracting browser credentials and cryptocurrency wallet passwords, and its creators even brag that it can extract credentials stored in SQL databases of various Web browsers and Windows Registry," the company said.

The attack is not the first time cybercriminals have used a legitimate software storage service as a distribution mechanism. Both GitHub and Bitbucket have been used by attackers in the past. 

Bitdefender's researchers believe the original compromise is accomplished by a brute-force attack of either the router itself or the Linksys Cloud account, which can be used to remotely manage a router. The attack could be using a vulnerability or other method, Arsene says. However, all evidence points to a broad brute-force scanning attack as the main culprit.

With so many workers using home networks and systems to connect to their companies' systems, such weakly secured routers are not just a consumer problem but an enterprise one as well, Arsene says.

"The router is the home user's gateway to the Internet," he says. "If you don't disable the Linksys cloud account or you don't update your firmware, it is game over for your entire network infrastructure."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Evict Attackers Living Off Your Land."