Well, this is crummy (albeit not surprising)—hackers have begun targeting home and small office routers with presumably weak passwords to change the DNS settings and redirect users to malicious websites masquerading as legitimate resources for Covid-19.
"Covid-19 is a recurring theme that cybercriminals have been abusing to trap victims. Malicious reports involving coronavirus-themed malware have increased five-fold in March from February, with attackers using phishing scams that exploit coronavirus misinformation and fear regarding medical supply shortage," BitDefender states in a blog post.
According to BitDefender, attackers are mostly focusing their efforts on Linksys-brand routers, though Bleeping Computer notes that D-Link models have been the target of related hacking attacks as well. In either case, hackers appear to be "brute forcing" their way into routers—i.e., attempting to guess passwords and passphrases, both locally and in the cloud.
Once inside, hackers change the DNS IP settings. The byproduct of this is being able to redirect web queries to specific websites, which in this case are ones purporting to be informational sites related to the coronavirus pandemic.
"What’s interesting is that, by changing the DNS settings on the router, users would actually believe they’ve landed on a legitimate webpage, except that it’s served from a different IP address. For example, when users type 'example.com', instead of the webpage being served from a legitimate IP address, it would be served from an attacker-controlled IP that’s resolved by the malicious DNS settings," BitDefender explains.
"If the attacker-controlled webpage is a spot-on facsimile, users would actually believe they’ve landed on a legitimate webpage, judging from the domain name in the browser’s address bar," BitDefender adds.
The spoofed websites encourage users to download an informational Covid-19 app in order to "have the latest information and instructions about coronavirus." It claims to be from the World Health Organization, but is definitely not.
Some of the targeted domains include washington.edu, aws.amazon.com, cox.net, disney.com, and redditblog.com, to name a few.
"It’s recommended that, besides changing the router’s control panel access credentials (which are hopefully not the default ones), users should change their Linksys cloud account credentials, or any remote management account for their routers, to avoid any takeovers via brute forcing or credential-stuffing attacks," BitDefender says.
In addition, it's a good idea to make sure you are running the latest firmware version for your router.
