Team Cymru Tracks Quad7’s 7777 and 63256 Router Botnets

Summary

Team Cymru used port banners and NetFlow to identify 12,783 hosts potentially linked to Quad7’s 7777 and 63256 botnets, map seven management IPs, and connect activity to router types and proxied brute-force attacks.

Key points

In a 30-day period ending August 5, 2024, researchers identified 12,783 hosts across the two botnets; they caution scan data likely captures only part of the bot population.
Port 7777 hosts displayed an xlogin: banner and were associated mainly with TP-Link routers and some IP cameras; port 63256 hosts displayed an alogin: banner and were associated mainly with ASUS routers.
NetFlow analysis identified seven management IPs with high confidence. Four had also appeared in Sekoia research.
The researchers found links between the 7777 and 63256 infrastructures, while describing them as apparently operationally siloed; they observed no offensive activity from the 63256 botnet.
The analysis associates port 11288 with a SOCKS5 proxy used to relay brute-force traffic, including observed connections to login.microsoftonline[.]com.
The researchers say port 7777 provides operators with a remote shell on compromised devices. They recommend firmware updates, strong unique passwords, disabling unused services, and monitoring network activity.

Article Details

Attack Vectors: Quad7 bots on compromised routers expose TCP port 7777 with an xlogin: banner; a second group of bots exposes TCP port 63256 with an alogin: banner.
The botnet has been observed conducting low-volume brute-force attacks against Microsoft Azure instances and Microsoft 365 accounts, sometimes making only 2–3 login attempts per week.
A SOCKS5 proxy service on TCP port 11288 has been used to relay attack traffic toward third-party servers.
The 7777 botnet was associated mainly with TP-LINK routers and IP cameras; the 63256 botnet was associated mainly with ASUS routers.
Defensive Notes: Keep router firmware up to date to reduce the risk of compromise.
Use strong, unique passwords; disable unused services; and regularly monitor network activity for suspicious behavior.
Monitor for the described open-port and banner characteristics, and use hardware identification to hunt for potentially vulnerable devices.
Security teams can use Pure Signal Recon and Scout to track Quad7 activity, including by querying the reported IPs or combining open-port characteristics.

Indicators of compromise

Type	Indicator	Context
IPV4	`104[.]168[.]152[.]139`	Management IP observed communicating with compromised hosts on remote port 11288.
IPV4	`142[.]11[.]205[.]164`	Management IP observed communicating with compromised hosts on remote port 11288.
IPV4	`151[.]236[.]20[.]185`	Management IP observed communicating with compromised bots on remote ports 7777 and 11288; it was the only IP observed communicating with bots on remote port 7777.
IPV4	`151[.]236[.]20[.]211`	Management IP observed communicating with compromised hosts on remote ports 11288, 63256, and 63260, linking it to both botnet infrastructures.
IPV4	`23[.]227[.]196[.]73`	Management IP observed communicating with compromised hosts on remote port 11288.
IPV4	`23[.]254[.]201[.]175`	Management IP observed communicating with compromised hosts on remote port 11288.
IPV4	`23[.]254[.]209[.]118`	Management IP observed communicating with compromised hosts on remote port 11288.