Cybersecurity Policy Report, DoJ Indicts Operators of Botnet That Exploited End-of-Life Routers, (May 12, 2025)
A botnet that was used for a variety of malicious cyber operations has been dismantled, and four suspects from Russia and Kazakhstan have been charged with computer crimes, according to the Department of Justice.
The botnet “was created by infecting older-model wireless internet routers worldwide, including in the United States, using malware without their owners’ knowledge,” DoJ said in a news release.
The botnet was made available to cyber criminals for a fee as a “proxy service,” making malicious cyber traffic appear to be from Internet protocol addresses associated with residential routers, DoJ alleged in an indictment unsealed on Friday by the U.S. District Court for the Northern District of Oklahoma.
“Such residential proxy services are particularly useful to criminal hackers to provide anonymity when committing cybercrimes; residential—as opposed to commercial—IP addresses are generally assumed by Internet security services as much more likely to be legitimate traffic,” the indictment says.
The indictment charges Alexey Viktorovich Chertkov, Kirill Vladimirovich Morozov, Aleksandr Aleksandrovich Shishkin, and Dmitriy Rubtsov with conspiracy, damage to protected computers, and false registration of a domain name.
The U.S. District Court for the Eastern District of Virginia authorized the Federal Bureau of Investigation to seize Internet domains that were used to run the botnet, DoJ noted.
The Dutch National Police, Royal Thai Police, and Lumen Technologies, Inc.’s cybersecurity division, Black Lotus Labs, assisted in the investigation, it added.
In a blog posting, Black Lotus Labs recommended that individuals upgrade any small-office/home-office (SOHO) networking devices that are no longer supported by the vendor.
“Anonymity is the key to success for criminals of all stripes,” Black Lotus said. “In predatory fashion, they abuse equipment that has aged out of the vendor support lifecycle and cannot be patched or protected.”
“Proxy services have and will continue to present a direct threat to internet security as they allow malicious actors to hide behind unsuspecting residential IPs, complicating detection by network monitoring tools,” Black Lotus said.
“As a vast number of end-of-life devices remain in circulation, and the world continues to adopt devices in the ‘Internet of Things,’ there will continue to be a massive pool of targets for malicious actors,” it warned. “By targeting IOT and SOHO devices in the residential IP space, cybercriminals create a veil of legitimacy for their traffic that complicates tracking and mitigation efforts.”
News: FederalLegislation LitigationEnforcement DataSecurity