TheMoon IoT Botnet Targets ISPs
February 4, 2018
continue to find new ways to exploit the growing cache of
internet-connected devices. According to new threat
intelligence from CenturyLink, TheMoon is one of the latest
examples of how far these threats have evolved. TheMoon is a
modular botnet that targets vulnerabilities in routers
within broadband networks. In recent months, CenturyLink
Threat Research Labs discovered an undocumented module of
TheMoon designed to allow the botnet to be leveraged as a
service by other malicious actors.
•CenturyLink Threat Research Labs identified an undocumented module of TheMoon that is only deployed on MIPS devices, a common microprocessor architecture typically found in residential gateways and modems.
•TheMoon's new module turns an infected device into a SOCKS proxy, a service that can be used maliciously to circumnavigate internet filtering or obscure the source of internet traffic, allowing the botnet author to sell its proxy network as a service to others.
•CenturyLink Threat Research Labs observed a video ad fraud operator leveraging TheMoon as a proxy service, impacting 19,000 unique URLs on 2,700 unique domains from a single server over a six-hour period.
•CenturyLink blocked TheMoon infrastructure on its network to mitigate the risk to customers, in addition to notifying other network owners of potentially infected devices to help protect the internet.
•As many recent exploits have used known vulnerabilities that only worked on machines or devices that were not patched in a timely manner, CenturyLink encourages consumers to regularly update their home router firmware and to check with their ISPs to determine when their routers should be replaced.