FBI Details AVrecon Router Malware Used by SocksEscort Proxy Network
Summary
The article describes FBI findings that AVrecon infected routers in 163 countries for SocksEscort’s proxy network, detailing its infection and persistence methods, criminal uses, and recommended defenses.
Key points
- AVrecon reportedly targets exposed router services using remote-code-execution vulnerabilities, command injection, and weaknesses in SOAP interfaces; the FBI identified about 1,200 device models.
- The malware can update its configuration, open a remote shell, download other payloads, and tunnel traffic through SocksEscort relay servers.
- On some devices, attackers reportedly used the firmware update feature to install modified firmware that disables future updates and re-flashing, making a factory reset ineffective.
- The FBI estimates SocksEscort sold access to about 369,000 compromised devices since 2020, across 163 countries.
- Authorities observed the proxy network used for ad, banking, marketplace, and romance fraud, password spraying, and attempted website vulnerability exploitation.
- The FBI recommends updating router firmware, replacing end-of-life devices, disabling or restricting remote administration, changing default passwords, and monitoring for listed indicators.
Article Details
- Attack Vectors
- AVrecon scans the internet for routers with exposed vulnerable services and exploits remote-code-execution vulnerabilities, command-injection flaws, and weaknesses in exposed SOAP interfaces.
- On some vulnerable devices, operators use the built-in firmware update feature to install a custom image containing AVrecon and disable future updates and reflashing.
- AVrecon can open a remote shell to an attacker-controlled server and download and execute separate payloads.
- Compromised routers are used as SOCKS proxy nodes; SocksEscort customers reportedly routed activity through them for password spraying, fraud, and attempted website vulnerability exploitation.
- Defensive Notes
- Apply available firmware updates to SOHO routers and IoT devices; replace end-of-life devices that no longer receive security updates.
- Disable remote administration or restrict access with firewall rules, and change default passwords.
- Monitor network-connected devices for the filenames “x” and “dnssmasq” and for traffic to C2 domains and IP addresses listed in the FBI advisory.
- A power cycle may clear infection on devices without modified firmware, but does not ensure lasting protection if vulnerabilities remain unpatched; factory reset may not work on devices whose reset functionality has been disabled.
MITRE ATT&CK
T1090.002 · External ProxyCompromised routers serve as external SOCKS proxies through which SocksEscort customers route traffic.T1105 · Ingress Tool TransferAVrecon can download separate payloads onto an infected device.T1110.003 · Password SprayingThe article reports that SocksEscort infrastructure was used for password spraying.T1190 · Exploit Public-Facing ApplicationOperators reportedly exploit RCE, command-injection, and exposed SOAP-interface weaknesses on network devices.T1542.001 · System FirmwareOn some devices, operators install custom firmware containing AVrecon and disable future updating and reflashing.T1595.002 · Vulnerability ScanningAVrecon scans the internet for devices with exposed vulnerable services.
Malware
Vendors
CiscoIts modular C2 framework allows new exploit modules and targeted about 1,200 device models from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.D-LinkIts modular C2 framework allows new exploit modules and targeted about 1,200 device models from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.HikvisionIts modular C2 framework allows new exploit modules and targeted about 1,200 device models from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.MikroTikIts modular C2 framework allows new exploit modules and targeted about 1,200 device models from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.NETGEARIts modular C2 framework allows new exploit modules and targeted about 1,200 device models from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.TP-LinkIts modular C2 framework allows new exploit modules and targeted about 1,200 device models from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.ZyxelIts modular C2 framework allows new exploit modules and targeted about 1,200 device models from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.