FBI secretly took down massive Russian botnet last month

(Image credit: Shutterstock / BeeBright)

In March, the Federal Bureau of Investigation (FBI) took down a large-scale botnet belonging to a Russian state-sponsored threat actor known as Sandworm.

According to a TechCrunch report, Sandworm infected thousands of endpoints with Cyclops Blink malware, successor to the now-defunct VPNFilter. Cyclops Blink allows Sandworm to conduct cyber espionage, launch distributed denial of service (DDoS) attacks, brick compromised devices and disrupt networks. 

After receiving the green light from courts in California and Pennsylvania, the FBI removed Cyclops Blink from its C2 servers, disconnecting thousands of compromised endpoints. The Justice Department said the raid was a success, but still advised device owners to review the initial advisory and further secure their devices.

TechRadar needs yo...

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time. Thank you for taking part.

>> Click here to start the survey in a new window <<

Russian threat actors

Cyclops Blink had been active since February, the Department of Justice (DoJ) said, and while law enforcement had managed to secure some of the compromised devices, the majority were still infected and in use by the threat actors.

“The operation did not involve any FBI communications with bot devices,” the DoJ added.

Sandworm is a known threat actor working for the GRU, Russia's military intelligence unit. It is also known as Voodoo Bear and Electrum, and was responsible for the DDoS attacks in Georgia in 2008, as well as for the power outage in Ukraine, back in 2015. 

According to the nonpartisan membership organization Council on Foreign Affairs, Sandworm mostly targets industrial control systems, using a tool known as Black Energy. Besides cyber-espionage, the group is often engaged in DoS attacks, and is allegedly behind the 2017 NotPetya campaign. 

The same year, it spear-phished political parties, and local government agencies in France, including those related to the president. And in 2020, the US National Security Agency (NSA) accused the group of targeting email services worldwide.

“The actors exploited victims using Exim software on their public-facing MTAs by sending a command in the “MAIL FROM” field of an SMTP (simple mail transfer protocol) message,” the NSA said at the time.

Via TechCrunch

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.