THE DARKSIDE OF THEMOON

Summary from the TLDR InfoSec newsletter

This blog post discusses a multi-year campaign that targeted end-of-life small home/small office routers and IoT devices with an updated version of the TheMoon malware. The malware is associated with a proxy service called Faceless, used by cybercriminals for anonymity. The post also describes the global telemetry analysis of Faceless, its proxy server infrastructure, and the behavior of infected devices in the network.