FBI secretly took down massive Russian botnet last month
Thousands of devices severed from Cyclops Blink
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
In March, the Federal Bureau of Investigation (FBI) took down a large-scale botnet belonging to a Russian state-sponsored threat actor known as Sandworm.
According to aTechCrunchreport, Sandworm infected thousands ofendpointswith Cyclops Blinkmalware, successor to the now-defunct VPNFilter. Cyclops Blink allows Sandworm to conduct cyber espionage, launch distributed denial of service (DDoS) attacks, brick compromised devices and disrupt networks.
After receiving the green light from courts in California and Pennsylvania, the FBI removed Cyclops Blink from its C2 servers, disconnecting thousands of compromised endpoints. The Justice Department said the raid was a success, but still advised device owners to review the initial advisory and further secure their devices.
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time. Thank you for taking part.
Click here to start the survey in a new window«
Russian threat actors
Cyclops Blink had been active since February, the Department of Justice (DoJ) said, and while law enforcement had managed to secure some of the compromised devices, the majority were still infected and in use by the threat actors.
“The operation did not involve any FBI communications with bot devices,” the DoJ added.
Sandworm is a known threat actor working for the GRU, Russia’s military intelligence unit. It is also known as Voodoo Bear and Electrum, and was responsible for the DDoS attacks in Georgia in 2008, as well as for the power outage in Ukraine, back in 2015.
Russian cyberattacks were reportedly set to target Tokyo Olympics>Russian criminals accused of hacking this top email service>NotPetya attack - three years on, what have we learned?
According to the nonpartisan membership organization Council on Foreign Affairs, Sandworm mostly targets industrial control systems, using a tool known as Black Energy. Besides cyber-espionage, the group is often engaged in DoS attacks, and is allegedly behind the 2017 NotPetya campaign.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The same year, it spear-phished political parties, and local government agencies in France, including those related to the president. And in 2020, the US National Security Agency (NSA) accused the group of targetingemail servicesworldwide.
“The actors exploited victims using Exim software on their public-facing MTAs by sending a command in the “MAIL FROM” field of an SMTP (simple mail transfer protocol) message,” the NSA said at the time.
ViaTechCrunch
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This dangerous new malware is hitting Windows devices by hiding in games
Windows PCs targeted by new malware hitting a vulnerable driver
Steps to take when your phone number is publicly listed online
