CuraSec

tag: Router-Security · 3 items

Plan Evooo1Bot Linux botnet hijacks routers as SOCKS5 relay nodes
2026-08-16 · BleepingComputer · source ↗ #botnet#linux#router-security
  • Engineer — Plan: Audit internet-facing gateway devices and routers for signs of Mirai-variant compromise; harden by restricting management interfaces, disabling unused services, and ensuring firmware is current — no active KEV or PoC signals yet to force immediate action.
  • SOC/IR — Plan: Build or tune detections for anomalous SOCKS5 proxy traffic originating from edge/gateway devices; hunt for unexpected outbound relay behavior on routers in your estate since no specific IOCs are currently published.
  • Leader — Skip
Learn archived Zbtlink Routers Ship With Factory Backdoor Enabling Unauthenticated Root Shells
2026-08-06 · The Hacker News · source ↗ #hardware-backdoor#supply-chain#router-security
  • Engineer — Learn: Zbtlink is a niche brand unlikely to appear in enterprise infrastructure, and no enrichment signals indicate active exploitation; however, the finding that backdoors persist across 2+ years of firmware images is a useful supply-chain sourcing reminder when evaluating network hardware vendors.
  • SOC/IR — Learn: No IOCs or ATT&CK-mapped TTPs are available from the summary, and Zbtlink hardware is uncommon in enterprise estates, so there is no immediate hunt or detection to build; worth noting the beaconing behavior pattern if these devices ever appear in an asset inventory.
  • Leader — Learn: This reinforces hardware supply-chain risk from certain manufacturers but is not a systemic enterprise event; useful context for a future board conversation on network equipment sourcing standards, but no same-week action is warranted.
Plan archived US and allies warn of Russian state hackers targeting routers
2026-07-13 · BleepingComputer · source ↗ #russian-apt#critical-infrastructure#router-security
  • Engineer — Plan: The advisory targets vulnerable and misconfigured routers — audit your edge router configurations against the joint advisory’s hardening guidance and prioritize patching any unmanaged or end-of-life devices on the network perimeter this quarter.
  • SOC/IR — Plan: A nine-nation joint advisory signals a documented campaign with TTPs worth operationalizing; pull the full advisory for any ATT&CK mappings and IOCs and build or tune detections for lateral movement originating from router-adjacent network segments.
  • Leader — Plan: A coordinated advisory from nine countries on Russian state targeting of critical infrastructure raises the threat posture for the quarter — assess whether your sector is named in the advisory and prepare a brief for leadership on edge-device exposure and any vendor dependencies in that space.