In an alarming discovery, security firm Trend Micro has uncovered a significant cybercrime campaign attributed to the Water Barghest group, which is believed to be linked to Russian state-sponsored hackers. Since 2020, the group’s activities have involved the rapid infection of 20,000 IoT devices, which are swiftly listed as proxy networks within ten minutes of their initial compromise. This campaign employs highly efficient, automated tools to escalate its scale, making the infected devices available for rent on proxy marketplaces almost immediately after infection.
Rapid Proliferation of the Campaign
Automated Tools and Proxy Networks
Trend Micro attributes the rapid proliferation of this campaign to its use of efficient, automated tools. These tools enable the Water Barghest group to quickly transform compromised IoT devices into proxy networks marketed to cybercriminals and nation-state hackers. The objectives of these proxy networks are multifaceted and range from website scraping, accessing compromised assets, to launching cyberattacks. The primary goal of these activities is to help anonymize them using geo-located IP addresses, thus making it challenging for authorities to trace the actions back to the perpetrators.
The discovery of this cybercrime campaign coincides with the FBI’s takedown of the botnet infrastructure used by Pawn Storm in January, also known as APT28 and Forest Blizzard, linked to the Russian GRU. Following this takedown, Trend Micro proceeded to uncover the Ngioweb botnet operated by Water Barghest. This Ngioweb botnet employs a new version of malware active since 2020, targeting various IoT devices, including EdgeRouter, Cisco, DrayTek, Fritz!Box, and Linksys. The ability to compromise such a broad range of devices is primarily due to exploiting both n-day and zero-day vulnerabilities.
Initial Infection Process
The infection process of IoT devices begins with the exploitation of both n-day and zero-day vulnerabilities. Water Barghest meticulously identifies vulnerable devices by leveraging public databases like Shodan, which catalog exposed devices and their IP addresses. Once identified, the group deploys malware directly into the memory of these devices. Although this infection is quite potent, it is not persistent, meaning that a simple reboot of the device can remove it from the system.
Upon compromising the devices, they connect to command-and-control servers to perform speed and name server tests. Following these tests, the devices are rapidly listed for sale on the proxy marketplace. Despite previous law enforcement actions targeting similar services, such as VPNFilter and the Cyclops Blink botnet, many IoT devices remain susceptible to such attacks. The high demand for anonymizing services from advanced persistent threat (APT) groups and other sophisticated threat actors ensures the continued prevalence of campaigns like those conducted by Water Barghest.
Mitigation Strategies for IoT Devices
Security Measures and Continuous Monitoring
Trend Micro emphasizes that the systematic exploitation of IoT device vulnerabilities by the Water Barghest group presents a serious threat, affecting hundreds of thousands of devices. To mitigate these risks, the security firm advises against exposing IoT devices to unnecessary internet connections. In addition, it is crucial to implement robust security measures and continuously monitor the devices to detect and prevent malicious activities.
One of the key strategies to safeguard IoT devices is the frequent updating and patching of firmware to address known vulnerabilities. Organizations and individuals should also disable any services and features on their IoT devices that are not being actively used. This helps to limit the attack surface available to cybercriminals. Deploying network segmentation can also be effective, isolating IoT devices from critical infrastructure to contain any potential breaches.
Importance of User Awareness
In a worrying development, cybersecurity firm Trend Micro has identified a major cybercrime campaign connected to the Water Barghest group, which is suspected of having ties to Russian state-sponsored hackers. Since 2020, this group has been involved in the rapid infection of around 20,000 Internet of Things (IoT) devices. These compromised devices are taken over and added to proxy networks within just ten minutes of the initial breach. The campaign uses highly efficient, automated tools to scale up its operations quickly, making these infected devices available for rent on proxy marketplaces almost immediately after they are compromised. This swift and efficient process allows the Water Barghest group to expand their reach and capabilities significantly. The campaign’s automation and speed mark a troubling evolution in cybercrime, with serious implications for digital security. The affected IoT devices serve as gateways for further malicious activities, emphasizing the need for increased vigilance and enhanced cybersecurity measures to counteract these sophisticated threats.