—Ryan Williams, B1Daily

In a significant cybersecurity development, U.S. and Dutch authorities, in collaboration with Lumen Technologies’ Black Lotus Labs, have dismantled a vast proxy botnet operation known as “Operation Moonlander.” This network exploited over 7,000 compromised Internet of Things (IoT) and end-of-life (EoL) devices, providing anonymity to malicious actors and generating illicit profits exceeding $46 million.

The Mechanics of the Botnet

The botnet primarily targeted outdated routers and IoT devices, many of which lacked vendor support and security updates. These compromised devices were enrolled into a proxy-as-a-service model, allowing cybercriminals to rent access for fees ranging from $9.95 to $110 per month. Payments were made via cryptocurrency, facilitating anonymous transactions.

Black Lotus Labs’ telemetry revealed that, on average, 1,000 unique bots communicated weekly with command-and-control servers located in Turkey. Over half of these infected devices were situated in the United States, with significant numbers also found in Canada and Ecuador. The malware leveraged, known as “TheMoon,” exploited known vulnerabilities in EoL devices, emphasizing the risks associated with outdated hardware.

Implications for Cybersecurity

This operation underscores the critical importance of maintaining up-to-date hardware and software. Organizations must prioritize regular updates, patch management, and the replacement of unsupported devices to mitigate vulnerabilities. Additionally, comprehensive asset inventories and network visibility are essential to identify and address potential threats proactively.

Thank you for reading, and stay tuned for more episodes of The Other Side of the Firewall podcast on Monday, Tuesday, Wednesday, and Friday, as well as the Ask A CISSP podcast every Thursday. 

Stay safe, stay secure!

**The Other Side of the Firewall podcast is a product of RAM Cyber Consulting & Assessments, LLC. RAM Cyber Consulting & Assessments, LLC is a premier governance, risk, and compliance (GRC) consultancy dedicated to supporting the Defense Industrial Base (DIB), federal agencies, and corporate entities. We specialize in delivering expert guidance to ensure compliance, mitigate risks, and enhance cybersecurity postures. RAM Cyber is pending SDVOSB, VOSB, and 8(a) certification by the SBA, underscoring our commitment to excellence and service.

—Ryan Williams, B1Daily