Feds wield tech smarts, shut down Russia’s GRU botnet in chase

The US government has announced that it has taken down a botnet operated by Russia’s GRU military intelligence unit. The botnet was used for various malicious activities including phishing, data theft, and spying against American and foreign governments. The attack targeted over 1,000 home and small business routers that had been infected with the Moobot malware, a variant of Mirai. Non-GRU cybercriminals initially installed Moobot on the routers using default administrator passwords. Once the routers were infected, the GRU used the botnet to install their own scripts and files for cyber espionage purposes. The US government was able to neutralize the botnet by copying and deleting the malicious files and blocking remote management access to the routers. This is the second state-sponsored botnet that the US government claims to have disrupted in recent months, the first belonging to China’s Volt Typhoon. However, experts believe that the attackers will likely continue their activities with new schemes. Fancy Bear, the hacking group believed to be behind the botnet, has a history of targeting US elections.