After Quad7’s successful exfiltration of targeted systems’ passwords through a limited number of sign-in attempts meant to evade detection, Storm-0940 immediately utilized the stolen credentials to breach networks, conduct credential dumping, and deploy remote access trojans and proxy tools to ensure persistence as part of a possible cyberespionage attack, an analysis from the Microsoft Threat Intelligence team showed. While Quad7’s exact means of breaching SOHO routers remain uncertain, an OpenWRT zero-day vulnerability was previously noted by Sekoia researchers to have been leveraged by threat actors to hack one of its honeypots.

Source: SC Magazine