Hackers Hijack Home Routers & Change The DNS Settings to Implant Infostealer Malware
Researchers discovered a new form of attack that targeting the home routers and altering the DNS settings to redirect the victims to a malicious website that delivers the infostealer malware called “Osk” that seems to have emerged in late 2019.
Landing websites are posing with the information of Coronavirus pandemic and force victims to download the app that promises victims to provide “the latest information and instructions about coronavirus (COVID-19)” through the app.
COVID-19 Theme is nowadays badly abusing to trap victims using phishing attacks and exploit the victims to steal sensitive data.
Attackers also using Bitbucket, the popular web-based version control repository hosting service to store the malicious payload, and the Popular URL shorten service TinyURL to hide the link that redirects users to reach the Bitbucket.
Researchers from Bitdefender reported the following key finding of this attack.
1.Mostly targets Linksys routers, bruteforcing remote management credentials
2. Hijacks routers and alters their DNS IP addresses
3. Redirects a specific list of webpages/domains to a malicious Coronavirus-themed webpage
4. Uses Bitbucket to store malware samples
5. Uses TinyURL to hide Bitbucket link
6 . Drops Oski inforstealer malwareCompromising The Routers
Attacker probing the internet to find the vulnerable home router to perform the password brute-forcing attack and change the DNS IP settings.
DNS setting is playing an important role in resolving the right IP address to the corresponding domain names.
If the attackers change the DNS IP addresses from the targeted routers, it resolves the user request to any web page that controlled by the attacker.
The following list of the domain are targetted in this campaign:
- aws.amazon.com
- goo.gl
- bit.ly
- washington.edu
- imageshack.us
- ufl.edu
- disney.com
- cox.net
- xhamster.com
- pubads.g.doubleclick.net
- tidd.ly
- redditblog.com
- fiddler2.com
- winimage.com
Users will be redirected to the IP addresses ( 176.113.81.159, 193.178.169.148, 95.216.164.181 ) If the traffic passing through the compromised router and the user will try to reach the above domains.
Changing the DNS settings never raise any red flag and users would believe they’ve landed on a legitimate webpage other than a different IP address.
“The webpages display a message purportedly from the World Health Organization, telling users to download and install an application that offers instructions and information about COVID-19.” Bitdefender said.
Attacker set the initial hyperlink to https://google.com/chrome which is a clean and well-known domain, but actually, an “on-click” event is set that changes the URL to the malicious one which is hidden with TinyURL.
Once victims click the download button, a malicious file drop from the Bitbucket repository but the victims completely unaware of it.
“In the final stage of the attack, a malicious file packed with MPRESS is downloaded. This payload is the Oski stealer that communicates with a C&C server for uploading the stolen information.”
Bitdefender telemetry observed that most of the targeted vulnerable routers is attempted to exploit was located in Germany, France, and the United States.
