{
  "name": "Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks",
  "slug": "router-roulette-cybercriminals-and-nation-states-sharing-compromised-networks",
  "description": "TrendMicro highlights the dangers of internet-facing routers and elaborates on Pawn Storm's exploitation of EdgeRouters, complementing the FBI's advisory from February 27, 2024. Cybercriminals and nation-state actors share an interest in compromised routers used as an anonymization layer, with cybercriminals renting out compromised routers and nation-state threat actors like Pawn Storm and Sandworm using dedicated proxy botnets. The analysis focuses on a criminal botnet of Ubiquiti EdgeRouters, disrupted by the FBI in January 2024, which Pawn Storm accessed in April 2022 for persistent espionage campaigns.",
  "published": "2024-08-07T14:16:41+00:00",
  "created_at": "2024-08-07T14:16:41+00:00",
  "modified_at": "2024-08-07T14:41:58+00:00",
  "created_at_opencti": "2024-08-07T14:16:41+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-08-07",
    "botnet",
    "cybercrime",
    "espionage",
    "ngioweb",
    "proxy",
    "routers",
    "sshdoor"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "86.123.151.53"
      },
      {
        "id": "",
        "name": "32.143.50.222"
      },
      {
        "id": "",
        "name": "24.88.87.29"
      },
      {
        "id": "",
        "name": "193.34.166.176"
      },
      {
        "id": "",
        "name": "185.62.58.141"
      },
      {
        "id": "",
        "name": "185.227.137.200"
      },
      {
        "id": "",
        "name": "184.75.134.59"
      },
      {
        "id": "",
        "name": "185.62.58.20"
      },
      {
        "id": "",
        "name": "172.114.170.18"
      },
      {
        "id": "",
        "name": "xfgjgjkuykykgihguifdt.mywire.org"
      },
      {
        "id": "",
        "name": "vrrumover0.vrrum0.farted.net"
      },
      {
        "id": "",
        "name": "trompadiom.tutotame.bigbox.info"
      },
      {
        "id": "",
        "name": "terminal.ooguy.com"
      },
      {
        "id": "",
        "name": "speddot.seburn.net"
      },
      {
        "id": "",
        "name": "puffypuf.gleeze.com"
      },
      {
        "id": "",
        "name": "mumucnc.kozow.com"
      },
      {
        "id": "",
        "name": "moreover.lostgumball.com"
      },
      {
        "id": "",
        "name": "kjskrvmwerffssd.kozow.com"
      },
      {
        "id": "",
        "name": "li4858member.possessed.us"
      },
      {
        "id": "",
        "name": "gopremium.mooo.com"
      },
      {
        "id": "",
        "name": "founderside.joseulloa.cl"
      },
      {
        "id": "",
        "name": "enforcer.mywire.org"
      },
      {
        "id": "",
        "name": "dfgtjytdfs.work.gd"
      },
      {
        "id": "",
        "name": "clientrun.compuinter.com"
      },
      {
        "id": "",
        "name": "changepassword.giize.com"
      },
      {
        "id": "",
        "name": "underuvukent.com"
      },
      {
        "id": "",
        "name": "subonuker.name"
      },
      {
        "id": "",
        "name": "ultradomafy.net"
      },
      {
        "id": "",
        "name": "semiridinution-postepudency.com"
      },
      {
        "id": "",
        "name": "minixetepate.biz"
      },
      {
        "id": "",
        "name": "promexucate.com"
      },
      {
        "id": "",
        "name": "macrofocafify.org"
      },
      {
        "id": "",
        "name": "interocakate.com"
      },
      {
        "id": "",
        "name": "emelenalike.com"
      },
      {
        "id": "",
        "name": "decumify.net"
      },
      {
        "id": "",
        "name": "antihicipate.com"
      },
      {
        "id": "",
        "name": "packinstall.kozow.com"
      },
      {
        "id": "",
        "name": "fed8c98fc754aff95f8538b5bebce558eb274256b0265d4482a675b74e93cc93"
      },
      {
        "id": "",
        "name": "f88d12332d2f58459f989c7c41b5381e8aed9c8c30c1d11373f0d1eb0b340b9a"
      },
      {
        "id": "",
        "name": "f6541b569787aa050c54ad85976ac5b729697a022be188b0040d37aa91e49ae2"
      },
      {
        "id": "",
        "name": "ef6fe4140001cb099968acd5772452859adbe7b57496389fbbf2342f9047b962"
      },
      {
        "id": "",
        "name": "edefd297285090fe743f5c3b111bce54da40f43a32e15d8fa87b8a2c243f6d47"
      },
      {
        "id": "",
        "name": "e3ba85e0bc978013b145ebb4c2d583b33422da93787ab8fb2185b55478652d91"
      },
      {
        "id": "",
        "name": "dfc86b375e974b3092bbff41eb24db3281fb4fc104f1043a7afbf95f85a2c1d5"
      },
      {
        "id": "",
        "name": "c290ab5d8ce9fcaa91da3b488c93dee1a4d0581c1335f19cb48027a5a03fe525"
      },
      {
        "id": "",
        "name": "bd0ea597f24bb72f8db34b6b6d2c0bc70eb53df9eae40cdb216a13521145ab03"
      },
      {
        "id": "",
        "name": "ad3fd3eb7a3a276ec0d384afb5b75fe7d9fc047bb0dab40f9d55870d4520c1f3"
      },
      {
        "id": "",
        "name": "a4a95807f1c5b200d5d94e3e811a7c4af2d0d9ca88ca4d7f9d02015574f4716f"
      },
      {
        "id": "",
        "name": "95995686b9af8b56c3fed1dadccf8b2ed5f417bb4eb8947a406a6e943cca33c6"
      },
      {
        "id": "",
        "name": "944be9bb167a2f76fe2f539d3860bbf26301830c479bc68509af46e047993c8c"
      },
      {
        "id": "",
        "name": "88f2d42bf225c930bc644f82bbd229e170d53dd1072e846e2883265a7ac33301"
      },
      {
        "id": "",
        "name": "85a4151d790ab32d5321c6e71748b2446032e1775aedd0168be25f76bf4fe93f"
      },
      {
        "id": "",
        "name": "844cc1807cc5b628b7aa807ef3b682d051c8ad5427df3d3e36c7e7633bfc5768"
      },
      {
        "id": "",
        "name": "681a00df2e2cc680a4b68bdb6fe7d55c34d6d3fc35d462c78ebb659f9cb2cd60"
      },
      {
        "id": "",
        "name": "4d35ae9669db428b72b1aaadd21dbed44ad2fc678efc8110d89ff723e0497406"
      },
      {
        "id": "",
        "name": "53d687868fd7ab9e78aa09f696923bd3c057e4e50432d07210080474a8d879cb"
      },
      {
        "id": "",
        "name": "4a932ccc8a45db6897a11de118cdbf67062569112f1caa69793669c5c24be708"
      },
      {
        "id": "",
        "name": "2f182a6cb72712c340c2adb43843cfccb5916d236485de1c62fb40c883570824"
      },
      {
        "id": "",
        "name": "2ae805b68d7408cc40ad058bc0b8b2b5c29d77760084a5230448e47cec1c43f4"
      },
      {
        "id": "",
        "name": "28aee94e9a3f6c4296663bb853a5af5817ae109f066c88b7a245316a9a1e4712"
      },
      {
        "id": "",
        "name": "2847ae693533406defecb226bfe6d62dd36905ff07add4e773426bde83e85ddc"
      },
      {
        "id": "",
        "name": "17257ce42246b8c47f9ec639a6ffaca2bc14c21a22c4419bf468e3f1d491e330"
      },
      {
        "id": "",
        "name": "104e3ea9a190ba039488f5200824fe883b98f6fe01d05a1b55e15ed2199c807a"
      },
      {
        "id": "",
        "name": "0891588667da40da58ffaa8fedcddb0a9a172646ec12e6d0b9ce2acc2caa302b"
      }
    ],
    "malware": [
      {
        "id": "0c59be0f-4567-409e-bf14-072c0447a192",
        "name": "Ngioweb",
        "slug": "ngioweb"
      },
      {
        "id": "07c6bd3c-84e5-40e1-b523-d7f570e4b09d",
        "name": "SSHDoor",
        "slug": "sshdoor"
      }
    ],
    "intrusion_sets": [
      {
        "id": "legacy:intrusion:1794032103de7348",
        "name": "Pawn Storm",
        "slug": "pawn-storm"
      }
    ],
    "attack_patterns": [
      {
        "id": "30fcebc4-6a32-43bc-b86f-09ec8d055dbc",
        "name": "T1609"
      },
      {
        "id": "4bbdf41c-817c-448a-9513-aaea6bfbe8b4",
        "name": "T1568"
      },
      {
        "id": "4abf44e7-0c8c-48fc-9cc5-12fc33f919b6",
        "name": "T1211"
      },
      {
        "id": "7616ff60-a18f-4663-9824-b889aa01c8ce",
        "name": "T1588"
      },
      {
        "id": "3da78f6d-c968-43ce-b1f3-149ce4a042aa",
        "name": "T1556"
      },
      {
        "id": "99a1fb98-1a01-485b-b90a-a9f362f41a84",
        "name": "T1091"
      },
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "74d5f31c-5e2d-4aed-b8b9-4fabdde76dfa",
        "name": "T1598"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "29f7ff93-033b-4f8d-8691-5bcaa438c80f",
        "name": "T1592"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/66b39de921cdfe8b6ebcc220"
  ]
}