U.S. FBI says it disrupted Russian hackers (updated)

Asustek Computer

06/04/2022 20:31

(Adds attempts to reach embassy and companies for comment)
    By Sarah N. Lynch
    WASHINGTON, April 6 (Reuters) - The U.S. Federal Bureau of
Investigation has wrested control of thousands of routers and
firewall appliances away from Russian military hackers by
hijacking the same infrastructure Moscow’s spies were using to
communicate with the devices, U.S. officials said on Wednesday.
    An unsealed redacted affidavit described the unusual
operation as a pre-emptive move to stop Russian hackers from
mobilizing the compromised devices into a “botnet” - a network
of hacked computers that can bombard other servers with rogue
traffic.
    "Fortunately, we were able to disrupt this botnet before it
could be used,” U.S. Attorney General Merrick Garland said.
    The Russian Embassy in Washington did not immediately return
an email seeking comment.
    The targeted botnet was controlled through malware called
Cyclops Blink, which U.S. and UK cyberdefense agencies had
publicly attributed in late February to “Sandworm,” allegedly
one of the Russian military intelligence service’s hacking teams
that has repeatedly been accused of carrying out cyberattacks.
    Cyclops Blink was designed to hijack devices made by
WatchGuard Technologies Inc  WTCHG.UL  and ASUSTeK Computer Inc
 2357.TW , according to research by private cybersecurity firms.
It provides Russian services with access to those compromised
systems, offering the ability to remotely exfiltrate or delete
data or turn the devices against a third party. 
    WatchGuard and AsusTek, better known as Asus, did not
immediately return messages seeking comment.
    FBI Director Chris Wray told reporters the FBI, with court
approval, secretly reached into thousands of routers and
firewall appliances to delete the malware and reconfigure the
devices.
    "We removed malware from devices used by thousands of mostly
small businesses for network security all over the world," Wray
said. "We shut the door the Russians had used to get into them."
    The affidavit noted that U.S. officials launched an
awareness campaign “to inform owners of WatchGuard devices of
the steps they should take to remediate infections or
vulnerabilities” and yet less than half the devices had been
fixed to expel the hackers.
    The affidavit noted that the FBI had carried out its work in
cooperation with WatchGuard.
    The announcement came amid a flurry of new sanctions
announced against Russian banks and elites, days after grim
images emerged of the bodies of civilians shot at close range in
the town of Bucha.  urn:newsml:reuters.com:*:nL5N2W35OM
    Russia says its "special military operation" is aimed at
demilitarizing and "denazifying" Ukraine, and it has denied
targeting civilians.

 (Reporting by Sarah N. Lynch. Writing by Raphael Satter. Satter
and Christopher Bing also contributed reporting; Editing by
David Gregorio)
 ((Raphael.Satter@thomsonreuters.com;))