The F.B.I., working with other countries, disrupted a Russian hacking operation that infiltrated more than 1,000 home and small-business internet routers in the United States and around the world, the Justice Department announced on Thursday.
Russian intelligence, collaborating with cybercriminals, created a botnet, or a network of private computers infected with malicious software, to spy on military and security organizations and private corporations in countries like the United States.
Using a court order, the F.B.I. secretly copied and deleted stolen data and malware from hacked routers. Doing this stopped Russia’s ability to use the routers without affecting how they function, officials said.
The F.B.I. director, Christopher A. Wray, shared details of the operation at an annual security conference in Munich.
The lack of detail in this article makes it rather useless. However, the original press release answers the obvious questions:
It was Ubiquiti (UBNT) routers running EdgeOS, with admin passwords that had not been changed from the default, and the admin interface exposed on internet-facing port(s) at some time in the past.
It’s 2024 and the practice of uniform default admin accounts is still alive and well?
You’re right that default credentials should have gone away a decade ago. From my experience with security cameras, default credentials were the norm ~5 years ago and now most prompt you to create a unique password. That industry typically lags slightly in infosec best practices. I would expect routers to require a higher level of security.
These are old deprecated devices on old firmware, not new routers
No longer the case with ubiquiti products, you’ll see these are old deprecated devices, on old firmware
This is the best summary I could come up with:
The F.B.I., working with other countries, disrupted a Russian hacking operation that infiltrated more than 1,000 home and small-business internet routers in the United States and around the world, the Justice Department announced on Thursday.
The disruption is part of a broader effort to stymie Russia’s cybercampaigns against the United States and its allies, including Ukraine.
The details of the operation come a day after the Biden administration said it told Congress and its European allies that Russia is seeking to create a space-based nuclear weapon to target the U.S. network of satellites.
Speaking in Munich, Mr. Wray said Russia continued to target critical infrastructure, such as underwater cables and industrial control systems, around the world.
“And that’s a particularly worrisome trend because we know that once access is established, a hacker can switch from information gathering to attack quickly and without notice.”
announced it disrupted a similar campaign from China that targeted critical infrastructure, often by infiltrating small businesses, contractors or local government networks.
The original article contains 374 words, the summary contains 165 words. Saved 56%. I’m a bot and I’m open source!
