FBI shuts down massive Russian botnet

What’s happened?

On Apr 6, 2022 officials at the FBI announced that they had successfully dismantled a network of Russian bots (also known as a botnet) which could have been used against targets in the US.

According to the FBI, the botnet was operated by the GRU, Russia’s forgien military intelligence agency. It ran on the same code as malware that was previously used by Russia against WatchGuard Technologies, a major firewall and cybersecurity provider.

While it’s not clear exactly who or what the botnet was intended to target, it’s easy to see how it fits into the larger pattern of Russian cyber aggression.

What is a botnet?

A botnet is a network of multiple devices which can all be operated from a remote control center. To create a botnet, hackers (or state-backed actors) will infect individual computers, laptops, and other smart hardware with malware.

The malware can lie dormant for months, unbeknownst to a device owner, until it’s finally activated by the control center.

A hacker can then send commands remotely to all the nodes in the network. This allows them to launch DDoS attacks, flooding websites and online services with artificially inflated traffic and forcing them offline.

Why would Russia do this?

Russia has a long history of cyberattacks and online warfare. Its online operations intensified in the months leading up to the invasion of Ukraine, and things have only escalated from there.

We can’t say for certain what this botnet was intended for, but it could have been used to disrupt a wide range of US businesses, government agencies, and websites. Russian authorities regularly test and probe US defenses — in 2021, both the SolarWinds hack and the Colonial Pipeline attack were linked to Russian hackers.

With relations between Russia and the US hitting historic lows, it’s not surprising that covert cyber operations are intensifying.

Will we see similar incidents in the future?

It’s very probable that incidents like this will continue. While Russia is militarily inferior to the US, cyber warfare offers it a chance to level the playing field. It’s almost certain that Russia will continue to pursue this strategy.

Huge portions of US infrastructure are now connected to the internet, from energy grids to healthcare services, so Russian cyberattacks have the potential to wreak havoc.

On this occasion, the botnet was taken down before it could be put to full use, but this won’t be the last time the Russian government tries to take advantage of an increasingly weaponized cyberspace.