#moobot — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #moobot, aggregated by home.social.
-
Nice #MooBot botnet
Botnet C2 domain:
🔥 putin.zelenskyj .ruPointing to:
45.88.90.30:43957 (AS203168 Constant MOULIN 🇧🇪)DNS resolution provided by Cloudflare 🔎
Payload URLs:
🌐 https://urlhaus.abuse.ch/host/45.88.90.30/Payload:
📄 https://bazaar.abuse.ch/sample/21f1caac3024e9d7424612573dd8523ad3f877c95674e1562f2171a2b5ce21c1/ -
Fortinet warns that multiple botnets continue exploiting CVE-2023-1389 (8.8 high, disclosed 15 March 2023, added to CISA's KEV Catalog 01 May 2023) TP-Link command injection for wide-scale spread. Botnets include Moobot, Miroi, the Golang-based agent “AGoent,” and the Gafgyt Variant. The blog post explores their infection traffic patterns and offer insights into these botnets. 🔗 https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
#CVE_2023_1389 #TPLink #eitw #activeexploitation #botnet #moobot #miroi #agoent #mirai #gafgyt #threatintel #IOC
-
Fortinet warns that multiple botnets continue exploiting CVE-2023-1389 (8.8 high, disclosed 15 March 2023, added to CISA's KEV Catalog 01 May 2023) TP-Link command injection for wide-scale spread. Botnets include Moobot, Miroi, the Golang-based agent “AGoent,” and the Gafgyt Variant. The blog post explores their infection traffic patterns and offer insights into these botnets. 🔗 https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
#CVE_2023_1389 #TPLink #eitw #activeexploitation #botnet #moobot #miroi #agoent #mirai #gafgyt #threatintel #IOC
-
Fortinet warns that multiple botnets continue exploiting CVE-2023-1389 (8.8 high, disclosed 15 March 2023, added to CISA's KEV Catalog 01 May 2023) TP-Link command injection for wide-scale spread. Botnets include Moobot, Miroi, the Golang-based agent “AGoent,” and the Gafgyt Variant. The blog post explores their infection traffic patterns and offer insights into these botnets. 🔗 https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
#CVE_2023_1389 #TPLink #eitw #activeexploitation #botnet #moobot #miroi #agoent #mirai #gafgyt #threatintel #IOC
-
Fortinet warns that multiple botnets continue exploiting CVE-2023-1389 (8.8 high, disclosed 15 March 2023, added to CISA's KEV Catalog 01 May 2023) TP-Link command injection for wide-scale spread. Botnets include Moobot, Miroi, the Golang-based agent “AGoent,” and the Gafgyt Variant. The blog post explores their infection traffic patterns and offer insights into these botnets. 🔗 https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
#CVE_2023_1389 #TPLink #eitw #activeexploitation #botnet #moobot #miroi #agoent #mirai #gafgyt #threatintel #IOC
-
Fortinet warns that multiple botnets continue exploiting CVE-2023-1389 (8.8 high, disclosed 15 March 2023, added to CISA's KEV Catalog 01 May 2023) TP-Link command injection for wide-scale spread. Botnets include Moobot, Miroi, the Golang-based agent “AGoent,” and the Gafgyt Variant. The blog post explores their infection traffic patterns and offer insights into these botnets. 🔗 https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
#CVE_2023_1389 #TPLink #eitw #activeexploitation #botnet #moobot #miroi #agoent #mirai #gafgyt #threatintel #IOC
-
#Russian hackers hijack #Ubiquiti routers to launch stealthy attacks
"#EdgeRouters are often shipped with default credentials and limited to no firewall protections to accommodate wireless internet service providers (#WISP)," the joint advisory warns. "Additionally, EdgeRouters do not automatically update firmware unless a consumer configures them to do so."
#FBI disrupted a #botnet of EdgeRouters infected with #Moobot #malware by #cybercriminals not linked with #APT28
https://www.bleepingcomputer.com/news/security/russian-hackers-hijack-ubiquiti-routers-to-launch-stealthy-attacks/ -
Ermittlungserfolg gegen #Cyberkriminalität: Sicherheitsbehörden von Bund und Ländern haben unter Koordination von Bundeskriminalamt und Bundesverfassungsschutz und in Kooperation mit dem FBI das weltweite Botnetz #Moobot. Es wurde u.a. von der russischen Gruppierung APT28 genutzt.
Mehr Informationen: https://www.tagesschau.de/inland/innenpolitik/russisches-spionagenetzwerk-ausgeschaltet-100.html
-
#FBI Dismantles #Ubiquiti Router Botnet Controlled by #Russia
“Non-GRU cybercriminals installed the Moobot malware on Ubiquiti #EdgeOS routers that still used publicly known default administrator #passwords. #GRU hackers then used the #Moobot #malware to install their own bespoke scripts and files that repurposed the botnet, turning it into a global cyber #espionage platform,” agency said
https://www.securityweek.com/fbi-dismantles-ubiquiti-router-botnet-controlled-by-russian-cyberspies/ #ForestBlizzard #Sofacy #FancyBear #APT28Please patch and change #defaultpasswords
-
#FBI Dismantles #Ubiquiti Router Botnet Controlled by #Russia
“Non-GRU cybercriminals installed the Moobot malware on Ubiquiti #EdgeOS routers that still used publicly known default administrator #passwords. #GRU hackers then used the #Moobot #malware to install their own bespoke scripts and files that repurposed the botnet, turning it into a global cyber #espionage platform,” agency said
https://www.securityweek.com/fbi-dismantles-ubiquiti-router-botnet-controlled-by-russian-cyberspies/ #ForestBlizzard #Sofacy #FancyBear #APT28Please patch and change #defaultpasswords
-
#FBI Dismantles #Ubiquiti Router Botnet Controlled by #Russia
“Non-GRU cybercriminals installed the Moobot malware on Ubiquiti #EdgeOS routers that still used publicly known default administrator #passwords. #GRU hackers then used the #Moobot #malware to install their own bespoke scripts and files that repurposed the botnet, turning it into a global cyber #espionage platform,” agency said
https://www.securityweek.com/fbi-dismantles-ubiquiti-router-botnet-controlled-by-russian-cyberspies/ #ForestBlizzard #Sofacy #FancyBear #APT28Please patch and change #defaultpasswords
-
#FBI Dismantles #Ubiquiti Router Botnet Controlled by #Russia
“Non-GRU cybercriminals installed the Moobot malware on Ubiquiti #EdgeOS routers that still used publicly known default administrator #passwords. #GRU hackers then used the #Moobot #malware to install their own bespoke scripts and files that repurposed the botnet, turning it into a global cyber #espionage platform,” agency said
https://www.securityweek.com/fbi-dismantles-ubiquiti-router-botnet-controlled-by-russian-cyberspies/ #ForestBlizzard #Sofacy #FancyBear #APT28Please patch and change #defaultpasswords
-
#FBI Dismantles #Ubiquiti Router Botnet Controlled by #Russia
“Non-GRU cybercriminals installed the Moobot malware on Ubiquiti #EdgeOS routers that still used publicly known default administrator #passwords. #GRU hackers then used the #Moobot #malware to install their own bespoke scripts and files that repurposed the botnet, turning it into a global cyber #espionage platform,” agency said
https://www.securityweek.com/fbi-dismantles-ubiquiti-router-botnet-controlled-by-russian-cyberspies/ #ForestBlizzard #Sofacy #FancyBear #APT28Please patch and change #defaultpasswords
-
Hikvision video systems have become the targets of hackers in an attempt to conduct a cyberattack that has the role to drop a #DDoS botnet. The #botnet under discussion is dubbed #Moobot, being a #Mirai-based one. #vuln #cyber #threats #informatique
https://heimdalsecurity.com/blog/moobot-botnet-targets-unpatched-hikvision-video-systems/
