A new malware that targets small and home office (SOHO) routers has been discovered by Lumen Technologies. The malware has been named "AVrecon". Researchers determined the malware has infiltrated more than 70,000 machines and gained persistent hold in more than 40,000 of them in 20 countries.
SOHO routers pose a serious threat because these devices are not always automatically patched and updated and aren't regularly monitored, which significantly decreases the ability to detect malicious activity. With the prevalence of remote workers, corporate network defenders should take the following precautions:
- Continue to look for attacks on weak credentials and suspicious login attempts, even when they originate from residential IP addresses.
- Be aware that threat actors can spawn a remote shell and deploy subsequent modules.
- Protect cloud assets from communicating with bots that are attempting to perform password spraying attacks and begin blocking Indicators of Compromise (IoCs) with Web Application Firewalls.
- Consumers who use SOHO routers should regularly reboot their devices and install security updates and patches where available.
