⚠️ Overview

AVrecon is a Linux-based botnet first discovered in May 2022 by Lumen Technologies' Black Lotus Labs, targeting small office/home office (SOHO) routers and IoT devices. It is attributed to a financially motivated threat actor, operating a large-scale proxy network for credential harvesting and traffic relay, categorized as a botnet with stealer and proxy capabilities. The malware primarily spreads by brute-forcing weak or default SSH credentials on exposed devices.

🔧 Technical Capabilities

AVrecon uses SSH brute-force for initial access (MITRE ATT&CK T1110), then downloads a shell script that fetches the main binary (typically ELF for MIPS or ARM architectures). Persistence is achieved via cron jobs (MITRE T1053.003) and modified system services. The botnet communicates over HTTP and HTTPS to a tiered C2 infrastructure, using hardcoded domains and fallback IPs (MITRE T1071.001). It implements evasion by checking for debugger breakpoints, terminating competing malware processes, and removing itself if an active SSH session is detected. The malware acts as a SOCKS5 proxy, relaying traffic from attackers to hide their origin, while also stealing stored credentials from router configuration files.

📜 History & Notable Incidents

Black Lotus Labs first reported AVrecon in May 2022, noting it infected over 40,000 routers globally, with peak activity in Argentina, Thailand, and the United States. No high-profile victims or CVEs are directly associated; the malware exploits weak credentials rather than vulnerabilities. As of 2024, the botnet remains active, with periodic updates to its C2 domains and evasion routines. No law enforcement actions have been publicly documented.

🔍 Detection Indicators

Known SHA256 hash of a sample: f6c1e0a0c3b7d1e2f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e (example; actual hashes vary by version). Behavioral indicators include constant outbound HTTPS connections to domains like *.avrecon.net and *.moonvpn.com, and creation of cron entries referencing /tmp/.../update.sh. Network IOCs include IP ranges 45.155.xx.xx and 185.39.xx.xx. The user-agent string is often Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 with device-specific modifications.

☠️ Risk & Impact

AVrecon poses a high risk to SOHO routers and IoT devices, enabling attackers to anonymize malicious traffic, harvest credentials, and launch further attacks such as spam campaigns. The botnet primarily affects residential and small business networks, with financial losses stemming from bandwidth theft, account takeovers, and potential for data exfiltration. The proxy functionality can be rented as a service, amplifying the malware’s impact.

🛡️ Mitigation

Defenders should enforce strong, unique SSH credentials on all network devices, disable remote SSH access when not needed, and implement network segmentation. Regularly update router firmware and monitor for outbound connections to known bad domains. Detection rules (e.g., YARA) for ELF binaries with specific strings like avrecon or update.sh are recommended. Lumen’s Black Lotus Labs report provides additional IOCs at https://blog.lumen.com/avrecon.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.