Lumen Disrupts Cybercriminals Targeting Home and Office Routers

PR Newswire03-26

Black Lotus Labs reveals how TheMoon malware used end-of-life routers to power a notorious cybercrime service called Faceless, urges consumers to secure devices DENVER, March 26, 2024 /PRNewswire/ --...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2422764852?lang=en_US&edition=fundamental","thumbnail":"https://s.yimg.com/uu/api/res/1.2/fxUWekIf5xCxpHV0xQk7uA--~B/aD0zMjI7dz00MDA7YXBwaWQ9eXRhY2h5b24-/https://media.zenfs.com/en/prnewswire.com/f5d499bc12e26f5d4f5e6716ffed6a31","is_english":true,"pubTime":"2024-03-26 23:06","share_image_url":"https://static.laohu8.com/5f26f4a48f9cb3e29be4d71d3ba8c038","id":"2422764852","market":"us","top_or_hot":-1,"title":"Lumen Disrupts Cybercriminals Targeting Home and Office Routers","media":"PR Newswire","content":"<div>\n<p>Black Lotus Labs reveals how TheMoon malware used end-of-life routers to power a notorious cybercrime service called Faceless, urges consumers to secure devices \nDENVER, March 26, 2024 /PRNewswire/ --...</p>\n\n<a href=\"https://finance.yahoo.com/news/lumen-disrupts-cybercriminals-targeting-home-150600004.html\">Source Link</a>\n\n</div>\n","source":"yahoofinance","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Lumen Disrupts Cybercriminals Targeting Home and Office Routers</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nLumen Disrupts Cybercriminals Targeting Home and Office Routers\n</h2>\n\n<h4 class=\"meta\">\n\n\n2024-03-26 23:06 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://finance.yahoo.com/news/lumen-disrupts-cybercriminals-targeting-home-150600004.html><strong>PR Newswire</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Black Lotus Labs reveals how TheMoon malware used end-of-life routers to power a notorious cybercrime service called Faceless, urges consumers to secure devices \nDENVER, March 26, 2024 /PRNewswire/ --...</p>\n\n<a href=\"https://finance.yahoo.com/news/lumen-disrupts-cybercriminals-targeting-home-150600004.html\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BK4588","symbol_name":"碎股","start_time":0,"source_url":"https://finance.yahoo.com/news/lumen-disrupts-cybercriminals-targeting-home-150600004.html","article_id":"2422764852","we_media_id":null,"thumbnails":["https://s.yimg.com/uu/api/res/1.2/fxUWekIf5xCxpHV0xQk7uA--~B/aD0zMjI7dz00MDA7YXBwaWQ9eXRhY2h5b24-/https://media.zenfs.com/en/prnewswire.com/f5d499bc12e26f5d4f5e6716ffed6a31"],"rights":{"source":"yahoofinance","url":"https://finance.yahoo.com/news/lumen-disrupts-cybercriminals-targeting-home-150600004.html","rn_cache_url":null,"customStyle":"img, svg { display: none !important; }","selectors":"article","filters":"","directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2422764852","pubTimestamp":1711465560,"sourceInfo":{"source_id":"yahoofinance","name":"雅虎金融"},"weMediaInfo":null,"summary":"Black Lotus Labs reveals how TheMoon malware used end-of-life routers to power a notorious cybercrime service called Faceless, urges consumers to secure devices. DENVER, March 26, 2024 /PRNewswire/ -- Black Lotus Labs, Lumen Technologies'  threat intelligence team, has identified a new multi-year campaign targeting end-of-life, or outdated small office/home office  routers and IoT devices. An updated version of TheMoon malware has reemerged and is fueling a cybercriminal anonymity service called Faceless. Lumen has stopped all traffic to and from the infrastructures associated with TheMoon and Faceless across its global network. Small office routers continue to be a key target for cybercriminals. In less than two years, Black Lotus Labs has discovered six large malware campaigns using compromised SOHO routers.For detailed technical analysis ofTheMoon and Faceless, read our latest blog, \"The Darkside of TheMoon\".","collect":0,"end_time":0,"defaultTopTitle":"yahoo.com","property":[],"viewcount":null,"language":"en","relate_stocks":{"BK4588":"碎股","BK4181":"酒店及度假村房地产投资信托","SOHO":"Sotherly Hotels Inc.","BK4554":"元宇宙及AR概念","BK4211":"区域性银行","BK4535":"淡马锡持仓","BK4218":"酒店及度假村房地产信托","HBCP":"Home合众银行","BK4195":"互助储蓄与抵押信贷金融服务","BK4585":"ETF&股票定投概念","BK4089":"非传统电信运营商","LUMN":"Lumen Technologies"},"translate_title":"Lumen破坏了针对家庭和办公室路由器的网络犯罪分子","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"HBCP":1,"SOHO":1,"LUMN":0.9},"content_text":"Black Lotus Labs reveals how TheMoon malware used end-of-life routers to power a notorious cybercrime service called Faceless, urges consumers to secure devices \nDENVER, March 26, 2024 /PRNewswire/ -- Black Lotus Labs, Lumen Technologies' (NYSE: LUMN) threat intelligence team, has identified a new multi-year campaign targeting end-of-life, or outdated small office/home office (SOHO) routers and IoT devices. An updated version of TheMoon malware has reemerged and is fueling a cybercriminal anonymity service called Faceless. Lumen has stopped all traffic to and from the infrastructures associated with TheMoon and Faceless across its global network. Small office routers continue to be a key target for cybercriminals. In less than two years, Black Lotus Labs has discovered six large malware campaigns using compromised SOHO routers.\n\n  \n\nFor detailed technical analysis of TheMoon and Faceless, read our latest blog, \"The Darkside of TheMoon\".\nCybercriminals join forcesLumen first reported on TheMoon in 2019. It reemerged in 2023 and quietly operated while growing to over 40,000 web robots (bots) from 88 countries in the first two months of 2024. Black Lotus Labs discovered that most of these bots are used as the foundation of a notorious, cybercriminal-focused proxy service known as Faceless. TheMoon allowed Faceless operators to anonymously send malicious traffic through outdated routers and devices owned by consumers and small businesses. \n\"Black Lotus Labs' advanced network visibility allows us to uncover threats other researchers can't see. TheMoon botnet quietly returned with its criminal operations, but we were able to see it and stop the attacks across our network,\" said Mark Dehus, senior director of threat intelligence at Lumen Black Lotus Labs. \"The attackers behind Faceless are using the botnets from this malware to create an anonymous proxy network by abusing outdated and unsupported routers to run their criminal networks. We believe these cybercriminals are using these networks to steal data and information from their victims, including the financial sector.\"\nHow it worksBlack Lotus Labs believes TheMoon is the main or sole provider of bots to Faceless. This proxy service gives its users the chance to impersonate a legitimate user in a chosen country. Faceless doesn't require customer identification. This allows users to stay anonymous as they send malicious traffic through the routers attempting to steal valuable data.\n\"TheMoon malware is a serious threat not only to the owners of the compromised SOHO devices, but also the victims exploited through this anonymous proxy network,\" continued Dehus. \"We urge consumers to update and secure their devices to prevent them from becoming part of these malicious networks.\"\nStopping the threatConsumers and businesses should take steps to protect their routers from cybercriminals.\n\nReboot: Consumers who use SOHO routers should regularly reboot their devices and install security updates and patches when available.\nUpdate old routers: Consumers and business should replace end-of-life devices with vendor-supported models to help ensure security updates are in place.\n\nIT professionals:\n\nInstall protection: Remote workers can invite threats to a company network. Install Web Application Firewalls to protect company assets from communicating with bots.\nMonitor activity: Look for suspicious login attempts, even those that come from residential IP addresses.\nEncrypt data: Use the latest cryptographic protocols, such as TLS (Transport Layer Security) to encrypt data sent over the internet. This helps secure email and website services.\n\nCybersecurity threats are growing and putting organizations at risk. Lumen will soon offer a new proactive defense solution that spots and isolates threats before they reach business networks and applications. This provides protection against advanced cyberattacks and malicious activity. Businesses can also turn to Lumen® Rapid Threat Defense, powered by Lumen Black Lotus Labs threat intelligence. The team uses global network data from the Lumen network, one of the world's largest and most deeply peered networks. Experienced researchers use their expertise to create machine learning algorithms that detect, classify, and validate threats.\nFor more tips on best practices for securing routers, visit Canadian Centre for Cyber Security.\nThreat protection continuesBlack Lotus Labs has added the threat intelligence from this campaign into the Lumen security portfolio to help quickly detect these threats in the future. The team continues to monitor new infrastructure to identify and stop suspicious behaviors and attacks. To help protect the larger cybercrime ecosystem, Lumen shares its research with experts in the broader security research community so they can also identify and act on these threats. \nAdditional information\n\nRead how Black Lotus Labs disrupted Chinese nation state cyber actors supporting recent Volt Typhoon attacks.\nRead about Black Lotus Labs' previous SOHO router malware discoveries including ZuoRAT, HiatusRAT, and AVrecon.\nLearn more about Lumen DDoS mitigation, DDoS Hyper®, and Lumen® SASE solutions.\n\nAbout Lumen Technologies:Lumen connects the world. We are igniting business growth by connecting people, data, and applications – quickly, securely, and effortlessly. Everything we do at Lumen takes advantage of our network strength. From metro connectivity to long-haul data transport to our edge cloud, security, and managed service capabilities, we meet our customers' needs today and as they build for tomorrow. For news and insights visit news.lumen.com, LinkedIn: /lumentechnologies, Twitter: @lumentechco, Facebook: /lumentechnologies, Instagram: @lumentechnologies, and YouTube: /lumentechnologies. \n View original content to download multimedia:https://www.prnewswire.com/news-releases/lumen-disrupts-cybercriminals-targeting-home-and-office-routers-302098978.html\nSOURCE Lumen Technologies","kind":null,"is_publish_news":null,"is_publish_highlight":null,"is_publish_live":null,"is_publish_wemedia":null,"editions":null,"symbols":[],"gpt_button":1},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"deviceId":"web-server-community-laohu8-v3","version":"4.22.4","shortVersion":"4.22.4","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2422764852"}