More than 45,000 routers have been compromised by a newly discovered campaign. The campaign is designed to open specific ports on routers so that systems on their local network can later be infected, as well as to launch additional attacks using EternalBlue. EternalBlue is an exploit created by the NSA and leaked online in April 2017.
The newly discovered campaign exploits a UPnP vulnerability in many routers, forcing them to open ports 139 and 445. As a result, any devices on the infected routers’ local network are directly accessible from the internet. With just 45,000 infected routers, the total number of devices (smart phones, PCs, tablets, servers, and more) that are accessible from the internet is approaching 2 million. While it is not yet certain how hackers will exploit all these devices, the ports that are activated give some hints about the spread of EternalBlue and EternalRed.
This attack is a variant of the attack analyzed in April. It is called UPnProxy because it uses the UPnP vulnerability to turn vulnerable routers into proxies that hide the origin of spam emails, DDoS attacks, and botnets.
According to Akamai researchers, who have dubbed the new variant EternalSilence, the variant injects commands into vulnerable routers. The new entry it creates is called “galleta silenciosa,” which translates to “silent cookie/cracker.”.
EternalBlue is a tool designed by the NSA. In 2017, a group called Shadow Brokers published the code that could be used to carry out the attack. A month later, EternalBlue was incorporated into the Wannacry ransomware, which managed to infect millions of systems in a short period of time. A month later, EternalBlue was also incorporated into the disk wiper known as NotPetya.
While security patches have been released since last year, many organizations still haven't applied them. However, that doesn't mean that all unpatched systems are vulnerable. If the ports mentioned are closed, then exploits can't spread.
This attack is not targeted. What they are trying to do is infect as many systems as they can, regardless of location, strength, or any other categorization.
