NCC Discovers Cyber Threats Targeting Windows Platforms and Routers

The Nigerian Communications Commission’s (NCC) Computer Security Incidents Response Team (CSIRT) has recently uncovered two distinct cyber threats affecting Windows platforms and a specific type of router. These discoveries were announced through separate advisories released earlier this week by the CSIRT.

The first threat identified is a ransomware called ‘Lokilocker,’ which has the ability to wipe data from all versions of Windows systems or platforms. This malicious software leads to data loss and denial of service (DoS), severely impacting user productivity.

Lokilocker is a relatively new ransomware variant that has been discovered by security researchers. It belongs to the ransomware family and operates by encrypting user files, rendering the compromised system useless until the victim pays the demanded ransom within the given timeframe.

To mask its malicious activities, Lokilocker displays a fake window update screen, cancels specific processes and services, and completely disables critical system components such as the task manager, Windows error reporting, machine firewall, and Windows Defender. The ransomware also incorporates processes that prevent data recovery by deleting backup files, shadow copies, and system restore points. It even modifies the user login note and alters the original equipment manufacturer (OEM) information in the compromised system’s registry.

In light of these threats, the NCC CSIRT advises users to always have a backup copy of their data stored offline to protect against Lokilocker and similar ransomware. Additionally, caution should be exercised while opening downloads and email attachments, even if they appear to come from trusted sources. Users are encouraged to scan attachments using up-to-date anti-malware solutions before opening them.

The second cyber threat identified by the NCC CSIRT is a botnet that specifically targets MicroTik routers. Thousands of vulnerable MicroTik routers are being exploited to create one of the largest botnets in history, according to CSIRT.

This botnet takes advantage of a known vulnerability that allows unauthenticated remote attackers to read arbitrary files and authenticated remote attackers to write arbitrary files through a directory traversal vulnerability in the WinBox interface. The exploit, which had been previously patched, enabled the perpetrators to enslave the routers and rent them out as a service.

Recent research conducted by Avast reveals that a cryptocurrency mining campaign utilizing the disrupted Glupteba botnet and the notorious Trickbot malicious software has been disseminated through the same command-and-control (C2) server. This C2 server operates as a botnet-as-a-service, controlling nearly 230,000 vulnerable MicroTik routers. The botnet has now been linked to the newly identified Meris Botnet.

The threats posed by this botnet include bypassing authentication, data loss, denial of service, remote code execution, password sniffing, and unauthorized access. These vulnerabilities expose victims to dangers such as malware distribution, cryptocurrency mining that drains system resources, remote code execution, and data theft.

To safeguard against this botnet, the NCC CISRT recommends users to promptly update their routers with the latest patches, set strong passwords for their routers, disable the administration interface from public access, refrain from using illegitimate or cracked versions of legitimate applications, employ reliable antivirus software with built-in web filtering, and apply the latest patches as soon as they become available.

By following these guidelines, users can fortify their systems and minimize the risks associated with these cyber threats, ensuring a safer online experience.

ncc.gov.ng