Compromised routers, SOHO gear and IoT stitched into botnets that obscure attribution and stage onward operations.
CISA and partners published tactics, techniques and indicators for covert networks built from compromised SOHO routers, IoT and smart devices. The advisory describes large-scale botnet infrastructure used to obscure attribution and enable reconnaissance and intrusion.
CISA and the FBI urged SOHO router manufacturers to build security into design and maintenance, citing ongoing targeting of small office and home office routers by Volt Typhoon.
NSA, FBI, CISA and Japanese partners detailed BlackTech tradecraft against branch routers, and urged multinationals to review subsidiary connections and consider zero trust to limit lateral movement.
CISA, NSA and FBI described continued exploitation of publicly known vulnerabilities in telecom and network service provider equipment to build a broad network of compromised infrastructure.