FBI warns over new malware targeting webcams and DVRs

Illustration of a laptop with a magnifying glass exposing a beetle on-screen

(Image credit: Shutterstock / Kanoktuch)

The FBI warned about the existence of new HiatusRAT malware
The malware can take over devices and grant remote access
Hackers are also targeting government agencies with it

A new Remote Access Trojan (RAT) malware has been detected targeting Chinese-branded web cameras and DVRs used in Western companies.

HiatusRAT, and it allows threat actors to “take over and control a targeted device from a distance”, says the FBI, which released a new Private Industry Notification (PIN) warning Hiatus’ operatives most likely kicked off their campaign in July 2022, and were looking to spy on US government organizations.

“Cybersecurity companies have also observed these actors using the malware to target a range of Taiwan-based organizations and to carry out reconnaissance against a US government server used for submitting and retrieving defense contract proposals,” the PIN says.

DVRs and web cams

The PIN noted the attackers were especially targeting web cameras and DVRs with known vulnerabilities, especially those who reached end-of-life, and those whose vendors are yet to patch the flaws.

Xiongmai and Hikvision were some of the names mentioned in the PIN, although the wording suggests that there are more vendors whose equipment is being targeted.

The FBI also said HiatusRAT scanned for IoT devices in the US, Australia, Canada, New Zealand, and the UK, for flaws including CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044, CVE-2021-36260. The crooks were also looking for devices with weak vendor-supplied passwords.

To run the scans, the attackers apparently used off-the-shelf, open-source software: “They used Ingram — a webcam-scanning tool available on Github — to conduct scanning activity,” the FBI said. “And they used Medusa — an open-source brute-force authentication cracking tool — to target Hikvision cameras with telnet access. Targeted TCP ports have included: 23, 26, 554, 2323, 567, 5523, 8080, 9530, and 56575.”

Another new router malware is sniffing around for your login details
Here's a list of the best antivirus
These are the best endpoint protection tools right now

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.