News & Analysis

Malicious Firmware Implant for TP-Link Routers

A report from Check Point Research has revealed of this firmware that is reportedly lined to the Chinese APT Group

Recently, Check Point Research investigated a sequence of targeted cyberattacks against European foreign affairs entities and attributed them to a Chinese state-sponsored Advanced Persistent Threat (APT) group dubbed “Camaro Dragon” by CPR. 

This activity has significant infrastructure overlaps with activities publicly linked to “Mustang Panda”. Our investigation discovered a malicious firmware implant created for TP-Link routers containing various harmful components, including a customized backdoor named “Horse Shell.” 

This backdoor enabled attackers to take full control of the infected device, remain undetected, and access compromised networks. CPR’s thorough analysis exposed these malicious tactics and provided a deep dive analysis.

Here we analyze the “Horse Shell” router implant and  share our insights into the implant’s functionality and compare it to other router implants associated with other Chinese state-sponsored groups. By examining this implant, we hope to shed light on the techniques and tactics utilized by the Camaro Dragon APT group to provide a better understanding of how threat actors utilize malicious firmware implants in network devices for their attacks.

The Attack

Our investigation of the ‘Camaro Dragon’ activity was of a campaign targeted mainly at European foreign affairs entities. However, even though we found Horse Shell on the attacking infrastructure, we do not know who the victims of the router implant are. 

Learning from history, router implants are often installed on arbitrary devices with no particular interest, with the aim to create a chain of nodes between the main infections and real command and control. In other words, infecting a home router does not mean that the homeowner was specifically targeted, but rather that they are only a means to a goal.

We are unsure how the attackers managed to infect the router devices with their malicious implant. It is likely that they gained access to these devices by either scanning them for known vulnerabilities or targeting devices that used default or weak and easily guessable passwords for authentication. Our findings not only contribute to a better understanding of the Camaro Dragon group and their toolset, but also to the broader cybersecurity community, providing crucial knowledge for understanding and defending against similar threats in the future.

Not only TP-Link

The discovery of the firmware-agnostic nature of the implanted components indicates that a wide range of devices and vendors may be at risk. 

Furthermore, our discovery of the firmware-agnostic nature of the implanted components indicates that a wide range of devices and vendors may be at risk. We hope that our research will contribute to improving the security posture of organizations and individuals alike. In the meantime, remember to keep your network devices updated and secured, and beware of any suspicious activity on your network

Protecting Your Network

The discovery of Camaro Dragon’s malicious implant for TP-Link routers highlights the importance of taking protective measures against similar attacks. Here are some recommendations for detection and protection:

Software Updates: Regularly updating the firmware and software of routers and other devices is crucial for preventing vulnerabilities that attackers may exploit.

Default Credentials: Change the default login credentials of any device connected to the internet to stronger passwords and use multi-factor authentication whenever possible. Attackers often scan the internet for devices that still use default or weak credentials.

Leave a Response