In a significant cyber incident, over 600,000 routers were incapacitated by a mysterious cyberattack known as “Pumpkin Eclipse” in late October 2023. This attack targeted a single internet service provider (ISP) in the United States, causing widespread disruption and necessitating extensive hardware replacements. The attack’s scale and the specific targeting of certain router models have raised concerns within the cybersecurity community.

Details of the Attack

Timeline and Impact

The attack occurred between October 25 and 27, 2023, affecting a vast number of users who experienced sudden connectivity loss. The routers were rendered inoperable, leaving customers without internet access and forcing the ISP to undertake a massive replacement operation. The disruption underscored the vulnerability of critical infrastructure to cyber threats.

Technical Analysis

Black Lotus Labs, the threat intelligence division of Lumen Technologies, conducted an analysis and identified the Chalubo remote access trojan (RAT) as the primary malware used in the attack. Chalubo, known for its capacity to execute DDoS (Distributed Denial of Service) attacks, was used to compromise the routers, exploiting weaknesses in the devices.

Targeted Devices

The attack specifically targeted the following router models:

• ActionTec T3200
• ActionTec T3260
• Sagemcom

These models were likely chosen due to known vulnerabilities or default credentials that could be easily exploited by the attackers. The method of attack suggests that weak passwords or exposed management interfaces were significant factors in the routers’ compromise.

Motives and Attribution

Potential Motives

While the exact motives behind the attack remain unclear, several potential reasons have been speculated:

• Disruption of Service: The primary impact was a significant disruption of internet services for hundreds of thousands of users.
• Data Exfiltration: There might have been attempts to harvest sensitive information from the compromised routers.
• Testing Capabilities: The attackers might have been testing the capabilities and reach of their malware.

Attribution Challenges

Attributing the attack to a specific entity has proven difficult. The complexity and scale of the operation suggest a well-organized group, possibly state-sponsored or a highly capable criminal organization. The use of a known trojan like Chalubo, however, does not necessarily point to a specific actor, as such tools are widely available on the dark web.

Response and Mitigation

Immediate Response

The affected ISP swiftly initiated a hardware replacement program to restore connectivity to its customers. This involved not only replacing the compromised routers but also implementing more stringent security measures to prevent future incidents.

Long-term Mitigation Strategies

In response to the attack, several long-term mitigation strategies have been recommended:

• Regular Firmware Updates: Ensuring that routers and other network devices receive regular firmware updates to patch known vulnerabilities.
• Strong Password Policies: Encouraging the use of strong, unique passwords for device management interfaces.
• Network Segmentation: Implementing network segmentation to limit the spread of malware in case of a breach.
• Increased Monitoring: Enhancing network monitoring capabilities to detect unusual traffic patterns that might indicate an ongoing attack.

Broader Implications

For ISPs and Customers

The attack on such a large number of routers highlights the importance of robust security practices for ISPs and their customers. ISPs need to prioritize security in their service offerings, while customers should be aware of the security features of their network devices.

For Cybersecurity Professionals

The incident serves as a reminder of the evolving threat landscape and the need for continuous vigilance. Cybersecurity professionals must stay updated on the latest threats and techniques used by attackers and ensure that their defenses are capable of withstanding sophisticated attacks.

Conclusion

The “Pumpkin Eclipse” cyberattack on over 600,000 routers in the U.S. marks one of the most significant cyber incidents in recent times. The use of the Chalubo RAT, the targeted router models, and the large-scale impact underline the urgent need for enhanced cybersecurity measures. As investigations continue, the cybersecurity community must work together to uncover the perpetrators and develop strategies to prevent similar attacks in the future

The post Massive Cyberattack Cripples Over 600,000 Routers in the U.S. appeared first on CyberHood Sentinel.

Medibank is one of the largest private health insurance company which covers around 4 million users.

The ransomware gang threatened that it would leak data allegedly stolen from Medibank’s systems within 24 hours. The gang is yet to reveal how much data it exfiltrated out of Medibank’s network and hasn’t shared any proof to verify that the data has been leaked.

Medibank refuses to pay the ransom

Medibank did not specify that which Ransomware gang has targeted the company , the company said in a press release published that it refused a ransom demand made by the attackers.

“Today, we’ve announced that no ransom payment will be made to the criminal responsible for this data theft,” Medibank said.

“Based on the extensive advice we have received from cybercrime experts we believe there is only a limited chance paying a ransom would ensure the return of our customers’ data and prevent it from being published.”

The health insurer added that paying the attackers would also likely motivate them to go after customers affected by the data breach.

Furthermore, a ransom payment will encourage others to attack Australian organizations, putting more people at risk.

“There is a strong chance that paying puts more people in harm’s way by making Australia a bigger target,” the company added. “This decision is consistent with the position of the Australian Government.”

Millions of users might be impacted due to this data leak

The ransomware gang starts leaking the allegedly stolen data to back their claims and attempt to force Medibank’s hand into negotiating a deal, the company revealed the attackers gained access to sensitive information belonging to millions of customers. Initially Medibank denied claims of data leak and access by the attackers.

The complete rundown of data Medibank believes was exposed in the breach includes the following:

• Name, date of birth, address, phone number, and email address for approximately 9.7 million current and former customers and authorized representatives
• Medicare numbers (but not expiry dates) for ahm health insurance (ahm) customers
• Passport numbers (but not expiry dates) and visa details for international student customers 
• Health claims data for roughly 480,000 Medibank, ahm, and international customers
• Health provider details, including names, provider numbers, and addresses

Medibank added that it also believes the cybercriminals behind the October attack have not gained access to financial information (credit card and banking details), primary identity documents (e.g., driver’s licenses), or health claims data for extras services (like dental, physio, optical and psychology).

“Given the nature of this crime, unfortunately we now believe that all of the customer data accessed could have been taken by the criminal,” Medibank

The post Medibank data on sale by the Ransomware Gangs appeared first on CyberHood Sentinel.

After successfully conducting the attack on US Colonial Pipeline DarkSide gang was facing increased scrutiny from international law enforcement and US.

During may the Darkside ransomware has abruptly shutdown its operation after losing access to their servers and cryptocurrency which was seized by an unknown third-party. 

In July a new ransomware operation known as BlackMatter emerged which is actively attacking victims and purchasing network access from other attackers to launch attacks.

Security researchers analyzing the Blakmatter decryptor and concluded that the encryption mechanism used by the BlackMatter is similar to the one used by the DarkSide ransomware gang.

Fabian Wosar told Bleeping computer that the encryption routines used by BlackMatter are pretty much the same, including a custom Salsa20 matrix unique to DarkSide.

When encrypting data using the Salsa20 encryption algorithm, a developer provides an initial matrix consisting of sixteen 32-bit words.

When encrypting files instead of using constant strings, a position, nonce, and key, for each encrypted file, DarkSide fills the words with random data.

This matrix is then encrypted with a public RSA key and stored in the footer of the encrypted file.

Fabian says this Salsa20 implementation was previously only used by DarkSide, and now BlackMatter.

DarkSide used an RSA-1024 implementation unique to their encryptor, which BlackMatter also uses.

While there is not 100% proof that BlackMatter is a rebrand of the DarkSide operation, many similar characteristics make it hard to believe this is not the case.

When we take the same encryption algorithms, the similar language used on the BlackMatter sites, similar craving of media attention, and similar color themes for their TOR sites, it is highly like that BlackMatter is the new DarkSide.

A rebrand from DarkSide also explains the reason the new BlackMatter group won’t target the “Oil and Gas industry (pipelines, oil refineries),” which led to their previous downfall.

Unfortunately, this is a highly skilled group that targets multiple device architectures, including Windows, Linux, and ESXi servers.

Due to this, we will need to keep an eye on this new group as they will surely perform attacks on well-known targets in the future.

The post Darkside Ransomware gang rebranded as BlackMatter Ransomware appeared first on CyberHood Sentinel.