image credit: unsplash
Dubbed ZouRAT, the malware has been deployed on devices in North America and Europe, as part of a sophisticated campaign targeting remote workers, which might have been conducted by a state-sponsored threat actor. At least 80 entities might have been impacted, the researchers estimate.
The attacks, which started in October 2020, targeted known vulnerabilities in SOHO routers from ASUS, Cisco, DrayTek, and NETGEAR for initial access, which then allowed the attackers to enumerate additional devices on the network and move laterally to more systems.
Comments are closed.
