Researchers at Lumen's Black Lotus Labs recently spotted evidence of a highly sophisticated and tightly targeted campaign aimed at SOHO (small office/home office) routers across both Europe and North America.

Based on the evidence the team has collected thus far, their conclusion is that the unidentified actor must be state-sponsored. This is because garden variety hackers do not typically have the tools, techniques, and procedures in place to pull off the kinds of attacks that the researchers are seeing.

It is telling that this campaign's ramp-up coincided with the pandemic-fueled shift to large numbers of employees working from home.

A recently published summary report about the campaign reads in part, as follows:

"This (the massive surge in people working from home) gave threat actors a fresh opportunity to leverage at-home devices such as SOHO routers - which are widely used but rarely monitored or patched - to collect data in transit, hijack connections, and compromise devices in adjacent networks.

The sudden shift to remote work spurred by the pandemic allowed a sophisticated adversary to seize this opportunity to subvert the traditional defense-in-depth posture of many well-established organizations."

The report goes on to say that:

"The capabilities demonstrated in this campaign - gaining access to SOHO devices of different makes and models, collecting host and LAN information to inform targeting, sampling and hijacking network communications to gain potentially persistent access to in-land devices and intentionally stealth C2 infrastructure leveraging multi-stage siloed router to router communications - points to a highly sophisticated actor that we hypothesize has been living undetected on the edge of targeted networks for years."

This is a genuine threat. Although your IT department is likely stretched as thin as it is, one of the best ways you can minimize your risk is to assist your employees who are working from home with patch planning to make sure their gear is up to date and as well protected as possible. And for those of you that work from home and don't have an IT department, you might want to consider some kind of work remote support plan that can give you a place to go when you have IT questions. And of course, someone to help you when you don't even know you have an IT issue!


Would you like to be a Power User? Sign up for "The Fix" our Mac Tips and Tricks newsletter here.
If you have any questions you can reach The MacGuys+ at 763-331-6227 or schedule an on-site visit here
Trusted Mac IT for business owners in Minneapolis, St. Paul, Twin Cities Metro, and Western WI Area! Nation Wide, Co-Managed, Work Anyplace Mac IT Support.

Used with permission from Article Aggregator