Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate of the General Staff (GRU)

DOJ ^ | 02/15/2024

[devane617]

A January 2024 court-authorized operation has neutralized a network of hundreds of small office/home office (SOHO) routers that GRU Military Unit 26165, also known as APT 28, Sofacy Group, Forest Blizzard, Pawn Storm, Fancy Bear, and Sednit, used to conceal and otherwise enable a variety of crimes. These crimes included vast spearphishing and similar credential harvesting campaigns against targets of intelligence interest to the Russian government, such as U.S. and foreign governments and military, security, and corporate organizations. In recent months, allegations of Unit 26165 activity of this type has been the subject of a private sector cybersecurity advisory

[devane617]

These guy has Fulton County Ga by the nads and have given them a deadline of 12:47pm tomorrow...

[ProtectOurFreedom]

The GRU relied on the “Moobot” malware, which is associated with a known criminal group. Non-GRU cybercriminals installed the Moobot malware on Ubiquiti Edge OS routers that still used publicly known default administrator passwords.

Ubiquiti are generally not home office routers. I cannot believe ANYBODY would leave the default administrator account active on ANY router and not change the default username or password.

I use an Ubiquiti wifi extender to cover our patio and it works well. But not many consumers have them. I installed it before the router manufacturers began adding their own extender product lines.

[Eagles6]

Fancy Bear is so old that he’s had both hips replaced and he’s still raiding our pikinik baskets?