頑張るJapanhttps://companydata.tsujigawa.com/press-20260207-002/
北島国際貿易株式会社（本社：東京都豊島区、代表取締役：藤原 拓雄）は、同社が展開するスマートアシストスーツケース「MOOBOT（ムーボット）」の第5世代モデルに向けた技術開発ロードマップを公開しました。
■プレスリリース配信元-北島国際貿易株式会社
https://companydata.tsujigawa.com/company/4010801030653/
securityaffairs#Russia-linked #APT28 and crooks are still using the #Moobot #botnet
https://securityaffairs.com/162706/apt/moobot-botnet-is-still-active.html
#securityaffairs #hacking #malware
https://securityaffairs.com/162706/apt/moobot-botnet-is-still-active.html
#securityaffairs #hacking #malware
abuse.ch 
Nice #MooBot botnet
Botnet C2 domain:
🔥 putin.zelenskyj .ru
Pointing to:
45.88.90.30:43957 (AS203168 Constant MOULIN 🇧🇪)
DNS resolution provided by Cloudflare 🔎
Payload URLs:
🌐 https://urlhaus.abuse.ch/host/45.88.90.30/
Payload:
📄 https://bazaar.abuse.ch/sample/21f1caac3024e9d7424612573dd8523ad3f877c95674e1562f2171a2b5ce21c1/
The Threat Codex
Not SimonFortinet warns that multiple botnets continue exploiting CVE-2023-1389 (8.8 high, disclosed 15 March 2023, added to CISA's KEV Catalog 01 May 2023) TP-Link command injection for wide-scale spread. Botnets include Moobot, Miroi, the Golang-based agent “AGoent,” and the Gafgyt Variant. The blog post explores their infection traffic patterns and offer insights into these botnets. 🔗 https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread
#CVE_2023_1389 #TPLink #eitw #activeexploitation #botnet #moobot #miroi #agoent #mirai #gafgyt #threatintel #IOC
Benjamin Carr, Ph.D. 👨🏻💻🧬#Russian hackers hijack #Ubiquiti routers to launch stealthy attacks
"#EdgeRouters are often shipped with default credentials and limited to no firewall protections to accommodate wireless internet service providers (#WISP)," the joint advisory warns. "Additionally, EdgeRouters do not automatically update firmware unless a consumer configures them to do so."
#FBI disrupted a #botnet of EdgeRouters infected with #Moobot #malware by #cybercriminals not linked with #APT28
https://www.bleepingcomputer.com/news/security/russian-hackers-hijack-ubiquiti-routers-to-launch-stealthy-attacks/
"#EdgeRouters are often shipped with default credentials and limited to no firewall protections to accommodate wireless internet service providers (#WISP)," the joint advisory warns. "Additionally, EdgeRouters do not automatically update firmware unless a consumer configures them to do so."
#FBI disrupted a #botnet of EdgeRouters infected with #Moobot #malware by #cybercriminals not linked with #APT28
https://www.bleepingcomputer.com/news/security/russian-hackers-hijack-ubiquiti-routers-to-launch-stealthy-attacks/
BMIErmittlungserfolg gegen #Cyberkriminalität: Sicherheitsbehörden von Bund und Ländern haben unter Koordination von Bundeskriminalamt und Bundesverfassungsschutz und in Kooperation mit dem FBI das weltweite Botnetz #Moobot. Es wurde u.a. von der russischen Gruppierung APT28 genutzt.
Mehr Informationen: https://www.tagesschau.de/inland/innenpolitik/russisches-spionagenetzwerk-ausgeschaltet-100.html
US-Operation: Behörden schalten russisches Spionagenetz aus
Sicherheitsbehörden in Deutschland und den USA haben ein globales Spionagenetz der Hackergruppe ATP 28 ausgeschaltet. Im Auftrag von Russland wurden offenbar Regierungen, Militär, Behörden und Konzerne ausgespäht - auch in Deutschland.
#FBI Dismantles #Ubiquiti Router Botnet Controlled by #Russia
“Non-GRU cybercriminals installed the Moobot malware on Ubiquiti #EdgeOS routers that still used publicly known default administrator #passwords. #GRU hackers then used the #Moobot #malware to install their own bespoke scripts and files that repurposed the botnet, turning it into a global cyber #espionage platform,” agency said
https://www.securityweek.com/fbi-dismantles-ubiquiti-router-botnet-controlled-by-russian-cyberspies/ #ForestBlizzard #Sofacy #FancyBear #APT28
Please patch and change #defaultpasswords
US Gov dismantled the #Moobot #botnet controlled by #Russia-linked #APT28
https://securityaffairs.com/159197/cyber-crime/feds-dismantled-moobot-botnet.html
#securityaffairs #hacking
https://securityaffairs.com/159197/cyber-crime/feds-dismantled-moobot-botnet.html
#securityaffairs #hacking
Mustafa Kaan DemirhanHeads up, security professionals! Cybercriminals are targeting Cacti and Realtek vulnerabilities with Moobot and ShellBot malware. Keep your systems and data safe by updating to the latest patched versions. #cybersecurity #CactiVulnerability #RealtekVulnerability #Moobot #ShellBot #staysecure
