07 December 2023

International operation takes down Russian RSOCKS botnet

A Russian operated botnet known as RSOCKS has been shut down by the US Department of Justice acting with law enforcement partners in Germany, the Netherlands and the UK. The DoJ said that the RSOCKS botnet operators managed to compromise target devices simply by conducting brute force attacks rather than taking advantage of any software security vulnerabilities. It appears that FBI investigators used the simple tactic of purchasing access to RSOCKS in order to get inside and identify its backend infrastructure and its victims. The initial undercover operation was as far back as 2017 and identified approximately 325,000 compromised devices throughout the world. According to the DoJ, victims of the RSOCKS botnet included a number of large public and private organizations, including a university, a hotel, a television studio, and an electronics manufacturer, as well as home businesses and numerous individuals.