DISMANTLED: Russian ‘RSocks botnet’ down after hacking millions of devices

The U.S. Department of Justice has announced the disruption of the Russian RSocks malware botnet used to hijack millions of computers, Android smartphones, and IoT (Internet of Things) devices worldwide for use as proxy servers.

The law enforcement operation involved the FBI and police forces in Germany, the Netherlands, and the United Kingdom, where the botnet maintained parts of its infrastructure.

What is a botnet?

A botnet is a swarm of devices that threat actors can remotely control to perform various behaviour, including DDoS attacks, crypto mining, and deploying additional malware.

In the case of RSocks, the botnet was used to convert residential computers into proxy servers, allowing the botnet’s customers to use them for malicious activity or to appear as coming from a residential IP address.

Typical use-case scenarios for these services include phishing operations, credential stuffing, account takeover attempts, etc. In addition, using a proxy service makes it harder for threat actors to be tracked by law enforcement, especially when those IP addresses belong to people unaware their devices were hijacked.

RSocks was also promoted for use by shopping bots, such as sneaker bots, that benefit from using residential IP addresses, which are usually not banned from online retailers.

An undercover investigation

FBI agents began mapping the RSocks infrastructure in an undercover operation where they purchased to access a large number of proxies in 2017.

According to the United State Department of Justice, the cost for accessing RSocks proxy pools ranged from $30 per day for 2,000 proxies to $200 per day for 90,000 proxies.

At that time, the investigators identified 325,000 compromised devices, many located in the United States. RSocks allegedly compromised these devices by brute-forcing their passwords and installing software on the breached computers to turn them into proxy servers.

“Several large public and private entities have been victims of the RSocks botnet, including a university, a hotel, a television studio, and an electronics manufacturer, as well as home businesses and individuals,” explains the DOJ announcement.

“At three of the victim locations, with consent, investigators replaced the compromised devices with government-controlled computers (i.e., honeypots), and all three were subsequently compromised by RSocks.”

While RSocks operation has been severely disrupted as a result of this international law enforcement operation, no arrests have been announced this time.

Botnet menace

Botnets are a constant and shape-shifting threat to poorly secured devices such as routers and other internet-connected “smart” IoT devices that are often neglected and left to operate unsupervised for extended periods.

To protect IoT devices, owners should always change the default administrator password to something stronger that’s hard to brute-force, apply the latest available firmware updates, and set up a separate network for IoTs, which are isolated from critical devices.

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

• Globally, 30,000 websites are hacked daily.
• 64% of companies worldwide have experienced at least one form of a cyber attack.
• There were 20M breached records in March 2021.
• In 2020, ransomware cases grew by 150%.
• Email is responsible for around 94% of all malware.
• Every 39 seconds, there is a new attack somewhere on the web.
• An average of around 24,000 malicious mobile apps are blocked daily on the internet.