Chinese Hackers Expand Malware Network

Malicious Infrastructure Uncovered

Chinese hackers, tracked as ' UAT-7810', are evolving their malware to expand their Operational Relay Box (ORB) network by compromising unpatched Ruckus routers. This activity was detected by Cisco Talos researchers. The hackers are actively targeting internet-facing devices.

The hackers' primary goal is to create a network of compromised devices that can be used to obfuscate the origin of their malicious activities. By compromising unpatched Ruckus routers, they are able to add new nodes to their ORB network. This allows them to mask their true identities and locations.

Cisco Talos researchers discovered that the hackers had developed a new malware tool, dubbed „LONGLEASH”, to facilitate the expansion of their ORB network. The malware is designed to compromise vulnerable devices and integrate them into the network. The researchers found that the hackers were using the compromised devices to proxy their traffic.

Can Security Teams Keep Up?

The use of compromised devices as proxies makes it challenging for security teams to detect and attribute the malicious activity. The hackers are able to hide their true IP addresses, making it difficult to track their activities. The researchers noted that the hackers were actively updating their malware to evade detection.

The rapid evolution of the hackers' malware poses a significant challenge for security teams. As the hackers continue to develop new tools and techniques, security teams must stay vigilant to detect and respond to the threats. The use of unpatched devices as entry points highlights the importance of keeping devices up to date.

The consequences of the hackers' activities are far-reaching, with potential impacts on organizations and individuals worldwide. As the ORB network continues to expand, the risk of malicious activity increases. Security teams must be proactive in detecting and mitigating the threats posed by the hackers.

Frequently Asked Questions

What is the primary target of the hackers? The primary target of the hackers is unpatched Ruckus routers. These devices are vulnerable to exploitation, allowing the hackers to compromise them.

How do the hackers use the compromised devices? The hackers use the compromised devices as proxies to mask their true IP addresses. This makes it challenging for security teams to detect and attribute the malicious activity.

What can be done to prevent compromise? Keeping devices up to date with the latest security patches can prevent compromise. Organizations should prioritize patching vulnerable devices to reduce the risk of exploitation.