Urgent Cybersecurity Threat: Cleaning Up Routers Infected by Russia’s APT28 Hacker Group (Moobot Malware)

In recent developments, the US government has taken significant action to combat the cyberespionage efforts of the Russian APT28 hacker group, also known as Fancy Bear or Sednit. This group, which has been linked to numerous high-profile cyberattacks, recently launched an attack that involved infecting routers with a malware called Moobot. This attack specifically targeted small office/home office (SOHO) routers and is a reminder of the dangers posed by unsecured network infrastructure. Here, we break down the details of the Moobot malware attack, offer a comprehensive removal guide, and provide preventive methods for avoiding future infections.

---

Details of the Moobot Malware Attack

The Moobot malware, which was used by APT28, compromised a botnet of Ubiquiti routers primarily used in SOHO environments. These routers were infected by exploiting default credentials and a trojanized OpenSSH server. Once inside the routers, APT28 actors took control of the devices, utilizing them for a variety of covert activities aimed at sensitive sectors across the globe. Below is a summary table of the details of this attack:

Category	Details
Threat Type	Malware (Moobot), Cyberespionage
Detection Names	“Moobot”, “APT28”, “Fancy Bear”, “Sednit”
Symptoms of Infection	– Slow internet speeds
	– Unusual router activity or settings
	– Sudden changes in router configurations
Damage	– Compromise of sensitive data
	– Unauthorized access to targeted systems
	– Deployment of further malicious payloads
Distribution Methods	– Exploitation of default credentials
	– Trojanized OpenSSH server processes
Danger Level	High (Cyber espionage, potential for massive data breaches and system infiltration)

APT28’s sophisticated tactics included exploiting zero-day vulnerabilities, leveraging the compromised routers for command-and-control (C2) infrastructure, and deploying custom backdoors like MasePie. This backdoor was designed to establish reverse proxy connections and SSH tunnels, which made it difficult to detect and remove the malware.

---

Removing Moobot Malware

If you believe your device or network might be infected with Moobot malware, it's critical to act immediately. The best course of action involves using an advanced anti-malware tool like SpyHunter to scan, detect, and remove the infection from your system. Below is a step-by-step guide to help you through the removal process:

Step 1: Install SpyHunter

1. Download SpyHunter: Download the latest version of the program. Ensure that you are downloading the correct version for your operating system.
2. Install SpyHunter: Once the download is complete, run the installation file. Follow the on-screen instructions to complete the installation process.

Step 2: Run a Full System Scan

1. Launch SpyHunter: Open SpyHunter and allow it to update its malware definitions.
2. Start the Scan: Click the "Scan" button to initiate a thorough scan of your system. This will check for malware, including Moobot, and other potential threats.
3. Wait for the Scan to Finish: Depending on your system’s size, the scan may take some time. Be patient as SpyHunter performs an in-depth analysis.

Step 3: Review Scan Results

1. Check for Infections: Once the scan is complete, review the results to see if Moobot or any other malicious files are detected.
2. Identify Potential Threats: SpyHunter will provide a list of identified threats. You can click on each threat for more detailed information about its nature and impact.

Step 4: Remove the Threats

1. Select the Infected Items: Choose the malware items listed for removal. SpyHunter allows you to select specific threats for removal or choose to delete all identified threats.
2. Initiate Removal: After selecting the threats, click on the "Remove" button to eliminate the malicious files from your system.
3. Restart Your System: Once the removal is complete, restart your computer to ensure all changes take effect.

Step 5: Reset Your Router

Since APT28 targeted routers in this attack, it is crucial to factory reset your router and apply recommended updates:

1. Factory Reset: Follow the router’s manual to perform a factory reset.
2. Update Firmware: Ensure that your router's firmware is up to date with the latest patches provided by the manufacturer.
3. Change Default Credentials: Change the default username and password to strong, unique credentials.
4. Configure Firewalls: Set up appropriate firewall rules to further secure your network.

---

Preventive Methods to Avoid Future Infections

Preventing future infections is crucial, especially given the ongoing nature of cyberespionage activities by APT28. Below are key preventive measures to safeguard your network and devices from similar threats:

Use Strong, Unique Passwords

Ensure that all devices on your network, including routers and IoT devices, are secured with strong, unique passwords. Avoid using default login credentials and employ a password manager to generate and store complex passwords.

Enable Multi-Factor Authentication (MFA)

Enable MFA wherever possible, especially for accounts with administrative access. This adds an additional layer of protection by requiring a second form of verification.

Update Firmware and Software Regularly

Keep your router’s firmware and any software on your devices up to date. Regularly check for updates and apply security patches to minimize vulnerabilities that could be exploited by attackers.

Disable Remote Access

Disable remote management features on your router unless absolutely necessary. This reduces the risk of external attackers gaining control over your router.

Install Security Software

Utilize comprehensive anti-malware software, such as SpyHunter, to provide continuous protection against a wide range of threats. Regularly update your security software to ensure it can detect the latest threats.

Monitor Network Traffic

Regularly monitor the traffic on your network for any unusual activity. If you notice an increase in traffic or unfamiliar devices connected to your network, investigate the issue immediately.

---

Conclusion

The Moobot malware attack carried out by APT28 has once again demonstrated the dangers posed by cyberespionage and the critical importance of securing network infrastructure. Organizations and individuals must act swiftly to address any potential infections, and SpyHunter provides a robust solution for detecting and removing the malware. By following the outlined preventive measures, you can strengthen your network defenses and avoid falling victim to similar cyber threats in the future.