ZuoRAT targets SOHO routers

Researchers have discovered a remote access Trojan currently being used against a wide range of small office-home office (SOHO) routers in Europe and North America potentially the work of a state sponsored actor infecting atleast 80 victims till now

The malware known as ZuoRAT, makes its way onto routers through exploits for known vulnerabilities. It can also infect other devices in the network and introduce additional malware via DNS and HTTP hijacking.

ZuoRAT is a MIPS file compiled for SOHO routers that can enumerate a host and internal LAN, capture packets being transmitted over the infected device, and perform person-in-the-middle attacks.

The malware targets routers from Cisco, Netgear, Asus, and DrayTek, although the report declined to specify individual router models.

Researchers noted that while compromising SOHO routers as an access vector to gain access to an adjacent LAN is not a novel technique. The use of DNS and HTTP hijacking techniques congruently demonstrated a high level of sophistication by a threat actor, indicating the possibility of a state sponsored organization.

The multi-stage campaign includes multiple fully functional Trojans, as well as complex and covert C2 and proxy C2 infrastructure to obfuscate command-and-control and evade detection.

The researchers found two other Trojans on the hacked devices. One was based on C++ and targeted Windows workstations. The other Trojan was based on the Go programming language and attacked Linux and macOS as well as Windows.

These Trojans allowed the attackers to start new processes, gain permanent access to infected systems, intercept network traffic, and upload or download arbitrary files.

If a SOHO router is unpatched or vulnerable to known security flaws, ZuoRAT poses a dangerous combination of reconnaissance and auth byypass exploit script and lateral-movement capabilities.

Educating users on how to protect their home networks, their passwords, their financial information, increases their engagement and builds cybersecurity hygiene.

This research was conducted and documented by Lumens threat intelligence.

Indicators of Compromise

• 7430b74cb4a374c0acbed1caf76cfe103d7b7861250b413602196d8dea00860f
• 9232382eebcb17f65fc1bfc4ae68b2bfe80ebacf9f962f4de650e9590910d04e
• a56e10f3a5be1ebd6716baa42699615fdc7270ce2986a1e79d041b7f44a2b71b
• 2f4359f91a92fa56d4aa0940ecb928042e20787b660c95e853e944ba92b02f17
• 3230ab2a8cd28ef9f463fabfb879df4ea00447605b18488d64e6fc12850371fc
• bf34ad9b62472761393ac2de942dd95db8869d6996701cbefeb1f1b96ca18ac1
• 31ce9fd09c2a889fc9caf4309b0f6c8f45d9d7a7bf2d5fabdc988f478ef2d03e
• 71d0de00734ef06e0f528f3ef328d965788d2e312b767c0b0c8435ab7b8cfc10
• ec059aaf18aca6da530e94c7e2d32f425007850b9054c3d204a2e842e36819f0
• daaa12fb1dd3b637dd0e73c225e4ca55b47f2eddfda2fc0345a3fd2232276da9
• 1cbb9ed1b3be4a06ed0497aba34bdbb05b52f663502dce097d147b26ae84cff2
• bf34ad9b62472761393ac2de942dd95db8869d6996701cbefeb1f1b96ca18ac1
• c2c6e542809952450c5ef0e47db354238e38c25ac8b0240f2b5e89616f899f0a
• e5063f5d97defb7e9f544ef77024650201c43e37364068ddbc05f299b42a3d5e
• 938bfd8179aa43ab80753d96c2ec0e6cfdc728715e03bbb3b315f95b94bf8bc3
• 7d6cc68a317038eaf1a5a7b29e78ec520cac24a26980759dee036a46be4b7c3d
• f9ca9a1b01f511eba0224fddb760886d8f5339bd5d4afcc6440525ec6ea90fd4
• dfe1135dfcf06e4b906a97a9720dc83e41d3f1c80e93c637b94ffec927acae05