MikroTik Mayhem: 13,000 Hijacked Routers Unleash Malware Madness!
A botnet of 13,000 hijacked MikroTik routers is spreading malware through spam, exploiting misconfigured DNS records. It cleverly uses SOCKS proxies to disguise malicious activities, making it a top-tier magician in the world of cybercrime. Owners should update their routers and change default credentials to avoid becoming part of this digital circus.
Hot Take:
In a chilling twist on “hijacking,” some 13,000 MikroTik routers are now moonlighting as unwitting malware delivery boys. Move over, pizza drones; it’s the age of the botnet delivery service—bringing chaos right to your inbox. And to think, your router just wanted to “connect” people!
Key Points:
- 13,000 MikroTik routers have been commandeered into a botnet for malware distribution.
- The botnet leverages misconfigured DNS records to sneak past email protections.
- A malspam campaign uses freight invoice lures to distribute an obfuscated JavaScript payload.
- Compromised routers are used as SOCKS proxies, hiding the origin of malicious traffic.
- 20,000 domains are exploited via permissive SPF records, enabling email spoofing.
Already a member? Log in here