Authorities Shut Down Russian RSOCKS Botnet That Hacked Millions of Devices

The U.S. Department of Justice (DoJ) on Thursday disclosed that
it took down the infrastructure associated with a Russian botnet
known as RSOCKS in collaboration with law enforcement partners in
Germany, the Netherlands, and the U.K.

The botnet, operated by a sophisticated cybercrime organization,
is believed to have ensnared millions of internet-connected
devices, including Internet of Things (IoT) devices, Android
phones, and computers for use as a proxy service.

Botnets, a constantly evolving threat, are networks of hijacked
computer devices that are under the control of a single attacking
party and are used to facilitate a variety of large-scale cyber
intrusions such as distributed denial-of-service (DDoS) attacks,
email spam, and cryptojacking.

“The RSOCKS botnet offered its clients access to IP addresses
assigned to devices that had been hacked,” the DoJ said^[1]
in a press release. “The owners of these devices did not give the
RSOCKS operator(s) authority to access their devices in order to
use their IP addresses and route internet traffic.”

Besides home businesses and individuals, several large public
and private entities, including a university, a hotel, a television
studio, and an electronics manufacturer, have been victimized by
the botnet to date, the prosecutors said.

Customers wanting to avail proxies from RSOCKS could rent access
via a web-based storefront for different time periods at various
price points ranging from $30 per day for access to 2,000 proxies
to $200 per day for access to 90,000 proxies.

Once purchased, criminal actors could then redirect malicious
internet traffic through the IP addresses associated with the
compromised victim devices to conceal their true intent, which was
to carry out credential stuffing attacks, access compromised social
media accounts, and send out phishing messages.

The action is the culmination of an undercover operation mounted
by the Federal Bureau of Investigation (FBI) in early 2017, when it
made covert purchases from RSOCKS to map out its infrastructure and
its victims, allowing it to determine roughly 325,000 infected
devices.

“Through analysis of the victim devices, investigators
determined that the RSOCKS botnet compromised the victim device by
conducting brute force attacks,” the DoJ said. “The RSOCKS backend
servers maintained a persistent connection to the compromised
device.”

The disruption of RSOCKS arrives less than two weeks after it
seized an illicit online marketplace known as SSNDOB^[2]
for trafficking personal information such as names, dates of birth,
credit card numbers, and Social Security numbers of about 24
million individuals in the U.S.