- Security researchers from Lumen’s Black Lotus were investigating the ngioweb botnet for more than a year
- After identifying the infrastructure and traffic, the company started blocking the data flow
- The botnet, and the proxy service NSOCKS, are severely disrupted as a result
Security researchers have disrupted a major malicious botnet, and thus also hurt the proxy service it powered.
Cybersecurity researchers from Lumen’s Black Lotus have released a new report saying they blocked all traffic across their global network that went to, or from, the dedicated infrastructure associated with the ‘ngioweb’ botnet.
The Ngioweb botnet, first spotted in mid-2023, operated more than 35,000 bots (compromised endpoints, basically) every day. The bots were located in 180 countries and were used, first and foremost, to power the NSOCKS proxy service. This “notorious criminal proxy service”, as Black Lotus describes it, is linked to the threat actor known as Muddled Libra. There are also indications that the proxy was used by state-sponsored threat actors such as APT28 (aka FancyBear, a known Russian threat actor).
Disrupting the operation
“At least 80% of NSOCKS bots in our telemetry originate from the ngioweb botnet, mainly utilizing small office/home office (SOHO) routers and IoT devices. Two-thirds of these proxies are based in the U.S.,” the researchers said.
A proxy service allows threat actors to run different malicious campaigns, while hiding their true identity and location, by using a “proxy” – or a middleman device.
Besides operating as a proxy, the ngioweb botnet could also be used to mount disruptive Distributed Denial of Service (DDoS) attacks.
Lumen took more than a year to analyze the botnet and its operations, and while it could not conclude exactly how the hardware was compromised, it speculated that it was most likely through various n-day vulnerabilities.
At press time, the NSOCKS proxy, and the underlying ngioweb botnet are being heavily disrupted by Lumen and its partners, given that the researchers found both the botnet’s architecture, and traffic.
Via BleepingComputer