A criminal proxy network has been found infecting thousands of Internet of Things (IoT) and end-of-life (EoL) devices, converting them into part of a botnet that provides anonymity for malicious users online.
The network, tracked over the past year by Lumen's Black Lotus Labs in cooperation with the US Department of Justice, the FBI and the Dutch National Police, exploits outdated residential devices to create a network of proxies.
The infrastructure is primarily based in Turkey and consists of five servers, one of which appears to collect data silently using UDP.
How the Proxy Network Works
The botnet targets unprotected IoT and SOHO devices, many of which are no longer supported with security updates. Lumen telemetry showed an average of 1000 active proxies each week across more than 80 countries, with the highest concentration of victims in the US, followed by Ecuador and Canada.
No tags.
