300+ Organizations Breached by Multiple DrayTek Vulnerabilities

Ransomware Operations Exploit DrayTek Vigor Router Vulnerabilities Affecting 300+ Organizations

Recent reports indicate that significant vulnerabilities in DrayTek Vigor routers have been exploited by various ransomware operations, impacting over 300 organizations in a coordinated attack campaign between August and September 2023. SecurityWeek highlights that the Monstrous Mantis operation was the initial perpetrator, successfully exfiltrating credentials from DrayTek devices and distributing them to affiliated groups, including Ruthless Mantis and LARVA-15. This alarming trend underscores the critical need for organizations to secure their network infrastructure against such threats.

Understanding the DrayTek Router Vulnerabilities

The vulnerabilities in DrayTek Vigor routers provided a gateway for cybercriminals, allowing them to penetrate organizational networks. The analysis by Forescout revealed that the Monstrous Mantis operation played a pivotal role in these attacks. Here’s a breakdown of how the campaign unfolded:

• Initial Exploitation: Monstrous Mantis exploited vulnerabilities to gain access to router credentials.
• Credential Sharing: These credentials were shared with other threat actors, including Ruthless Mantis and LARVA-15.
• Ransomware Deployment: Ruthless Mantis, linked to the notorious REvil group, used the stolen credentials to deploy Qilin and Nokoyawa ransomware on at least 337 organizations, primarily in the Netherlands and the UK.

Scope of the Attack

The impact of these ransomware operations was widespread, affecting organizations across multiple countries. Key insights include:

• Geographic Reach: Attacks were reported in the UK, Netherlands, Taiwan, France, Germany, Italy, Poland, and Turkey.
• Ransomware Variants: Qilin and Nokoyawa ransomware were primarily used in these attacks, with LARVA-15 reselling the exfiltrated credentials to other cybercriminals.

Strategic Operations by Cybercriminals

According to researchers, the operational strategy employed by Monstrous Mantis was particularly noteworthy. By selectively sharing credentials with trusted partners, they maintained control over victim allocation, which helped ensure operational secrecy. This approach allowed them to earn profits from attacks executed by their partners while minimizing their own risk exposure.

Prevention and Response Measures

Organizations can take several steps to mitigate risks associated with these vulnerabilities:

• Regular Firmware Updates: Ensure that DrayTek Vigor routers and all network devices are updated with the latest firmware.
• Change Default Credentials: Immediately change any default login credentials to strong, unique passwords.
• Monitor Network Traffic: Implement network monitoring solutions to detect unusual activity that may indicate an intrusion.

For more insights on how to protect your network, consider reading our articles on cybersecurity best practices and the importance of regular network audits.

Conclusion

The exploitation of DrayTek Vigor router vulnerabilities by ransomware operations illustrates a growing threat landscape for organizations worldwide. It is imperative for businesses to adopt proactive security measures to safeguard their networks against such cyber-attacks.

We invite you to share your thoughts on this issue or explore related articles to stay informed about the latest cybersecurity trends. For further reading, check out Forescout’s analysis and SecurityWeek’s coverage on the topic.