Thousands of hacked TP-Link routers being used to hijack Azure accounts

Hackers working on behalf of the Chinese government are using a botnet of thousands of routers, cameras, and other Internet-connected devices to perform highly evasive password spray attacks against users of Microsoft's Azure cloud service, the company warned Thursday.

The malicious network, made up almost entirely of TP-Link routers, was first documented in October 2023 by a researcher who named it Botnet-7777. The geographically dispersed collection of more than 16,000 compromised devices at its peak got its name because it exposes its malicious malware on port 7777.

Password spraying is a type of brute-force attack in which numerous login attempts are made from multiple IP addresses, making it difficult to detect the attacks because each individual device only attempts to log in a few times. With thousands of botnet devices at hand, you can see how effective this method could potentially be.

Once an Azure account is compromised, the malicious actors attempt to spread their infection to other parts of the network, exfiltrating data and installing backdoors for continued access.

Microsoft urges organizations to strengthen their cybersecurity by enforcing strict authentication policies, such as implementing multi-factor authentication, disabling legacy authentication methods, and adopting passwordless authentication.

Read more -here-