Purported Brute-Force Attack Aims at Linksys Routers as More People Work Remotely

The attack takes control of poorly secured network devices, redirecting Web addresses to a COVID-themed landing page that attempts to fool victims into downloading malware.

A cybercriminal group has started scanning the Internet for vulnerable Linksys routers in the first stage of an attack that ultimately aims to fool users into downloading and installing malware, security firm Bitdefender stated in an advisory this week.
The attack first compromises vulnerable routers by purportedly trying weak or default credentials and mainly targeting Linksys routers, the company said. Once an attacker gains access, they hijack DNS functionality, redirecting victims to a page that attempts to convince them to download a malicious, information-stealing program known as Oski. The attackers page aims to harness the fear of the coronavirus pandemic to fool victims.
Bitdefender discovered the attack after several users found their browsing blocked by the companys program, even though they were trying to visit legitimate sites.
The attack is not subtle, says Liviu Arsene, global cybersecurity research at Bitdefender. The page does not necessarily look legitimate, but considering that this is an attack that targets home users and home routers, the victims may not have the expertise to figure that out.
The attack joins a
general rise in malicious activity
aimed at home users as many of the worlds knowledge workers are sequestered at home in an effort to blunt the spread of the novel coronavirus. About 1,200 users have seemingly downloaded the malware between March 18 and March 23, the company said.
Multiple security firms have warned that attackers are using coronavirus-themed messages to attempt to lure users into clicking on malicious links.
While its not uncommon for hackers to piggyback global news, such as the pandemic, to deliver phishing emails laced with tainted attachments, this recent development proves they are nothing if not creative in compromising victims, Bitdefender
stated in a blog post on the attack
.
The attackers are focused on the US and European countries, according to the companys analysis. The US, Germany, and France account for 73% of the targeted routers.
The attack targets a list of legitimate Web pages and domains, including:
aws.amazon.com
goo.gl
bit.ly
washington.edu
imageshack.us
ufl.edu
disney.com
cox.net
xhamster.com
pubads.g.doubleclick.net
tidd.ly
redditblog.com
iddler2.com
winimage.com
When a user attempts to go to one of those domains, the compromised routers settings will send them to an attacker-controlled site claiming to be distributing a COVID information application from the World Health Organization. If the user clicks through to the landing page, they will be download a program from one of four Bitbucket repositories, Bitdefender stated in its analysis.
The program is a downloader that installs Oski, a relatively new Trojan developed in 2019.
Some of the features that it packs revolve around extracting browser credentials and cryptocurrency wallet passwords, and its creators even brag that it can extract credentials stored in SQL databases of various Web browsers and Windows Registry, the company said.
The attack is not the first time cybercriminals have used a legitimate software storage service as a distribution mechanism. Both GitHub and Bitbucket have been used by attackers in the past.
Bitdefenders researchers believe the original compromise is accomplished by a brute-force attack of either the router itself or the Linksys Cloud account, which can be used to remotely manage a router. The attack could be using a vulnerability or other method, Arsene says. However, all evidence points to a broad brute-force scanning attack as the main culprit.
With so many workers using home networks and systems to connect to their companies systems, such weakly secured routers are not just a consumer problem but an enterprise one as well, Arsene says.
The router is the home users gateway to the Internet, he says. If you dont disable the Linksys cloud account or you dont update your firmware, it is game over for your entire network infrastructure.
Related Content:
Attack Surface, Vulnerabilities Increase as Orgs Respond to COVID-19 Crisis
COVID-19: Getting Ready for the Next Business Continuity Challenge
100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
Most Home Routers Are Full of Vulnerabilities
Destructive VPNFilter Attack Network Uncovered
Check out The Edge, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
How to Evict Attackers Living Off Your Land
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Purported Brute-Force Attack Aims at Linksys Routers as More People Work Remotely