October 9, 2015 By Shane Schick 2 min read

A group calling itself the White Team appears to be the developer of Linux.Wifatch, a form of malware experts say has been secretly improving the security of otherwise vulnerable home routers.

As Security Intelligence reported earlier this week, a researcher from Symantec first noticed how the Linux.Wifatch malware was infecting devices but primarily focused on fending off other security threats rather than doing any damage of its own. Now, the same researcher told SecurityWeek about finding the project’s source code published online on GitLab by the White Team. The group posted notes along with the code, insisting the efforts were part of learning experiments and that the intention was never to cause any harm. Linux.Wifatch will now be made available under GNU public license.

However, Softpedia News noted that the Linux.Wifatch source code has not been released in its entirety. That’s likely because the White Team is worried that traditional cybercriminals would exploit the malware for more nefarious purposes. It also explains why it was a clandestine operation in which router owners weren’t aware their systems had been infected, even if it was only to defend them against black-hat attackers.

Whether or not anyone appreciates the White Team’s form of vigilante security tactics, they may believe the work should serve as a warning to those who don’t follow basic data protection procedures, Hacked said. For example, there are still untold numbers of home routers that use default passwords and leave admin access wide open to malware and other threats.

For businesses and CISOs, the situation with Linux.Wifatch could also be a reminder that home routers are just the tip of the iceberg in terms of potential malware targets. As Dark Reading suggested, the move to connect more everyday devices as part of the Internet of Things will likely mean the nature of a network changes constantly, blurring the lines between professional and personal boundaries.

Unless we want to depend on more groups like the White Team to keep data safe, everyone’s going to have to work hard to prove they can do a better job of keeping cybercriminals at bay.

More from

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded files with potentially dangerous extensions by mid-2023, have changed the threat landscape for the better. Improved endpoint detection also likely forced attackers to shift away from other techniques prominent in 2022, such as using disk image files (e.g. ISO) and…

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today