Over 70K SOHO devices targeted by new AVrecon botnet

More than 70,000 small office/home office routers have been infiltrated by the novel AVrecon botnet for over two years, making it one of the largest botnets targeted at SOHO devices ever, The Hacker News reports. AVrecon consists of 40,000 nodes across 20 countries, with the U.K., U.S., Argentina, Nigeria, and Brazil accounting for most of the infections, according to a Lumen Black Lotus Labs report. After enumerating a targeted SOHO router, AVrecon proceeds to track other malware instances and lets the compromised system communicate with another command-and-control server before enabling advertising fraud and data theft through malicious Facebook and Google ads, as well as Microsoft Outlook interactions. "The manner of attack seems to focus predominantly on stealing bandwidth without impacting end-users in order to create a residential proxy service to help launder malicious activity and avoid attracting the same level of attention from Tor-hidden services or commercially available VPN services," said researchers.