FBI accesses US servers to dismantle botnet malware installed by Russian spies

The FBI remotely accessed and disinfected US-located devices running a powerful new strain of Russian state botnet malware, federal authorities said Wednesday. Those authorities added that the Kremlin was using the malware to wage stealthy hacks of its adversaries

The infected devices were primarily made up of firewall appliances from WatchGuard and, to a lesser extent, network devices from Asus. Both manufacturers recently issued advisories providing recommendations for hardening or disinfecting devices infected by the botnet, known as Cyclops Blink. It is the latest botnet malware from Russia’s Sandworm, which is among the world’s most elite and destructive state-sponsored hacking outfits.

Regaining control

Cyclops Blink came to light in February in an advisory jointly issued by the UK’s National Cyber Security Center (NCSC), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI). WatchGuard said at the time that the malware had infected about 1 percent of network devices it made.

Cyclops Blink was a replacement for another piece of Sandworm-designed malware known as VPNFilter, which researchers discovered in 2018 infecting 500,000 US-based routers made by Linksys, MikroTik, Netgear, QNAP, and TP-Link. The FBI quickly seized a server Sandworm was using to infect devices with VPNFilter. Once that was completed, the bureau instructed the public to reboot their devices. With that, the botnet was dismantled.

Cyclops Blink was Sandworm’s attempt to regain persistent control of networking devices, and the malware almost worked. In a court affidavit unsealed Wednesday, federal prosecutors wrote:

As with VPNFilter, Sandworm actors have deployed Cyclops Blink on network devices worldwide in a manner that appears to be indiscriminate; i.e., the Sandworm actors’ infection of any particular device appears to have been driven by that device’s vulnerability to the malware, rather than a concerted effort to target that particular device or its owner for other reasons. The Sandworm actors have done so through the exploitation of software vulnerabilities in various network devices, primarily WatchGuard firewall appliances. In particular, the WatchGuard devices are vulnerable to an exploit that allows unauthorized remote access to the management panels of those devices.

The botnet persisted even after February 23. That’s when WatchGuard, in coordination with the FBI, released instructions for returning disinfected devices to a clean state and configuring the devices to prevent unrestricted access to management interfaces. WatchGuard also fixed a vulnerability tracked as CVE-2022-23176, which opened the authentication bypass hole when servers were configured to allow unrestricted management access from external IP addresses. Despite the CVE issued this year, WatchGuard said Wednesday, the vulnerability was fully addressed in May 2021.

Slippery slopes and the law of unintended consequences

Following the February advisory, however, the number of devices in the Cyclops Blink fell by just 39 percent. In response, the FBI went one step further than it did with VPNFilter in 2018. In a clandestine takedown operation cloaked by a federal warrant, agents remotely accessed infected WatchGuard devices connected to 13 US-based IP addresses. From there, the agents:

• confirmed the presence of the Cyclops Blink malware
• logged the serial number Cyclops Blink used to track its bots
• copied a list of other devices also infected by Cyclops Blink
• disinfected the machines
• closed Internet-facing management ports to prevent Sandworm from having remote access

It’s not the first time the FBI has remotely accessed an infected device to remove a threat, but it’s among them. Many security professionals have raised concerns that such moves have the potential to cause harm if they accidentally disrupt a mission-critical processes. Privacy advocates have also decried the exposure such actions may have on private individuals’ information.

Jake Williams, a former hacker for the NSA and now executive director of security firm Cyber Threat Intelligence, said the same concerns surround this case, although he said the specific steps the FBI took left him feeling more comfortable. In a message, he wrote:

I think it’s always dicey for LE [law enforcement] to modify anything on a server that they don’t control. However, in this case I don’t think there was significant risk so the benefits clearly outweighed the risks. Many will cite slippery slope arguments as reasons this particular action was improper, but I think that’s wrong. The fact that the FBI coordinated with private enterprise (WatchGuard) in this action is particularly significant.

The FBI affidavit said that last September, agents interviewed representatives of a company operating an infected device on its network. The company allowed the agents to take a forensic image of the machine and to “prospectively observe the network traffic associated with the firewall appliance.”