These aren’t the kind of mainstream Wi-Fi routers for most consumers. Trickbot is known for using ports 443 and 449, and we were able to verify that some target servers were identified as TrickBot C2 servers in the past.I’ve been wanting to write about MikroTik routers for some time. “In this case, it is being used for malicious activity. “The said command is a legitimate network address translation (NAT) command that allows the NAT router to perform IP address rewriting,” Microsoft researchers explained. The command then redirects data through port 80 to command TrickBot servers. That command creates a new rule, similar to iptables, that receives data from compromised computers through port 449. For example, one command Microsoft observed Trickbot sending was: /ip firewall nat add chain=dstnat proto=tcp dst-port=449 to-port=80 action=dst-nat to-addresses= dst-address= MikroTik shells, by contrast, offer Trickbot operators a menu of useful options. They won’t normally work on regular Linux-based shell windows. The commands, which are preceded by “/”, include things like /ip, /system, and /tool. Trickbot operators can send a single command that causes large numbers of the devices to funnel traffic in specific ways that are beneficial to the botnet architecture. The flexibility and power of the commands make MikroTik routers an ideal proxy. This operating system allows users to remotely pipe commands that use the SSH, or secure shell, protocol. Microsoft said a chief reason Trickbot has such an affinity for MikroTik is MikroTik's unique Linux-based RouterOS. The location of the control servers themselves remains hidden and can’t be detected without access to the proxy router. When security analysts monitor the connections infected computers make, the researchers see IP addresses belonging to compromised routers inside homes and businesses. Instead of infected computers connecting directly to the control servers, the computers connect to the compromised routers, which act as go-betweens. Trickbot operators, Microsoft said on Wednesday, are compromising MikroTik devices and using those devices to conceal the location of the command and control servers that exchange data and commands with infected computers. The malware often uses readily available software like Mimikatz or exploits like EternalBlue, which was stolen from the National Security Agency. It excels at gaining powerful administrator privileges, spreading rapidly from computer to computer in networks, and performing reconnaissance that identifies infected computers belonging to high-value targets. The malware driving Trickbot is notable for its advanced capabilities. Since then, Trickbot has mushroomed into one of the Internet's most aggressive threat platforms, thanks to its highly modular, multistage malware framework that provides a full suite of tools that are used to install ransomware and other forms of malware from other hacking groups. Trickbot came to light in 2016 as a trojan for stealing account passwords for use in bank fraud. Now, Microsoft has finally figured out why and how the routers are being put to use. For years, malicious hackers have been hacking large fleets of MikroTik routers and conscripting them into Trickbot, one of the Internet’s most destructive botnets.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |