Researchers Discover Home Router DNS Attack That Spreads Coronavirus-Themed Malware

Researchers at Bitdefender announced the discovery of a new attack that is targeting home routers. In the attack, the DNS settings in the router are changed to redirect the victim to a website that delivers the Oski infostealer malware as the final payload. The most interesting aspect of the malware is that it stores the malicious payload using Bitbucket, which is a popular web-based control repository hosting service.

The sneaky malware takes steps to avoid alerting the victim that their router has been compromised, including abusing TinyURL to hide the link to the Bitbucket payload. The page that users are redirected to talks about the coronavirus pandemic and offers a download to give users updated information on the virus. We've talked before about how people can track the coronavirus pandemic without risking a malware infection.

Key findings in the investigation found that the malware mostly targets Linksys routers and uses brute force to steal remote management credentials. Once it has access to the router remotely, it changes the DNS IP addresses to redirect to a specific list of webpages/domains to a malicious coronavirus-themed website to deliver the malware. The attackers are reportedly probing the Internet to discover vulnerable routers they can attempt to exploit.

Once attackers change the DNS IP addresses, they can resolve any request the user enters and redirect users to webpages that the attackers control without anyone knowing. DNS IP addresses that the malware uses include 109.234.35.230 and 94.13.82.249. Once compromised, some of the target domains that are specifically redirected include aws.amazon.com, Washington.edu, imageshack.us, cox.net, redditblog.com, Disney.com, and xhamster.com.

Those websites and many others are redirected to a page that displays a message that is supposed to be from the World Health Organization, offering to download an application having to do with COVID-19. Estimates are that about 1193 routers have been compromised by the attack so far. To mitigate risk users should change cloud account credentials from default and use strong passwords.