MOSCOLLECTOR TAKEDOWN – 9th of April 2024
—————————————————————<\/p>\n
Russia’s Industrial Sensor and Monitoring Infrastructure has been disabled:
[moscollector.ru](https:\/\/www.moscollector.ru\/)
Hacked data is available at
[https:\/\/ruexfil.com\/mos](https:\/\/ruexfil.com\/mos\/)
It includes Russia’s Network Operation Center (NOC) to monitors and control Gas, Water, Firealarm
and many others, including a vast network of remote sensors and IoT controllers. A total of 87,000
sensors have been disabled.<\/p>\n
Milestones:
– Initial access June 2023.
– Access to
[112 Emergency Service](https:\/\/ruexfil.com\/mos\/takedown\/112-emergency-service.png)
.
– 87,000
[sensors](https:\/\/ruexfil.com\/mos\/takedown\/sensors)
and controls have been disabled (including Airports, subways, gas-pipelines, …).
–
[Fuxnet](https:\/\/ruexfil.com\/mos\/takedown\/fuxnet\/)
(stuxnet on steroids) was deployed earlier to slowly and physically destroy sensory equipment
(by NAND\/SSD exhaustion and introducing bad CRC into the firmware).
– Fuxnet has now started to flood the RS485\/MBus and is sending ‘random’ commands to 87,000 embedded
control and sensory systems (carefully excluding hospitals, airports, …and other civilian targets).
– All servers have been deleted. All routers have been reset to factory reset. Most workstations (including
the admins workstations) have been
[deleted](https:\/\/ruexfil.com\/mos\/takedown\/)
.
– Access to the office building has been disabled (all key-cards have been invalidated).
– Moscollector has recently been
[certified by the FSB](https:\/\/ruexfil.com\/mos\/takedown\/FSB\/fsb-certifies-mos.jpg)
for being ‘secure & trusted’ (picture included)
– Defaced the webpage (https:\/\/web.archive.org\/web\/20240409020908\/https:\/\/moscollector.ru\/)<\/p>\n
The media pack, screenshots and videos are available here:
[https:\/\/ruexfil.com\/mos\/takedown](https:\/\/ruexfil.com\/mos\/takedown\/)
(
[.onion](http:\/\/cnqdc7cn4y5t6l5mxmyhwrp6wbneialihcdidc6a6ctdcrhktzmdbiqd.onion\/)
)<\/p>\n
It contains:
– GPS coordinates of all 87,000 sensors
– Database of their internal and
[secure Messaging](https:\/\/ruexfil.com\/mos\/takedown\/dumps\/)
Platform (Dialog; used by Moscollector employees).
– Screenshots of the Network Operation Centre
– Screenshots of servers, routers, databases, …
– Screenshots of maps, blueprints of buildings, … etc etc
– Screenshots accessing their domain registrar
– Screenshots of FuxNet source code and mode of operation
– Video of FuxNet deploying and disabling the sensors<\/p>\n
The Op was conducted by BlackJack.<\/p>\n
— After takedown report
– About 1,700 sensor routers were destroyed. The central command-dispatcher and DataBase has been destroyed.
=> All 87,000
[sensors are offline](https:\/\/ruexfil.com\/mos\/takedown\/fuxnet\/)
– Key-cards to enter the office and server rooms have been invalidated
– All databases have been
[wiped](https:\/\/ruexfil.com\/mos\/takedown\/)
.
– All mail has been
[wiped](https:\/\/ruexfil.com\/mos\/takedown\/)
.
– A total of 30TB of data has been wiped. Including the backup drives.
– Zabbix and other internal staging and monitoring servers have been wiped.
– All admin workstations and most user workstations have been wiped.
– Exhausted the corporate credit card.
– Took control of their
[domain](https:\/\/ruexfil.com\/mos\/takedown\/domain\/we-now-own-their-domain.png)
“moscollector.ru”.
=> Our server stats:
[WEB Traffic](https:\/\/ruexfil.com\/mos\/takedown\/domain\/domain-stolen-traffic.png)
,
[Email Traffic](https:\/\/ruexfil.com\/mos\/takedown\/domain\/domain-stolen-emails.png)
– Took down their
[Firewall](https:\/\/ruexfil.com\/mos\/takedown\/takedown_firewall.png)
and disabled their Internet.
– Webpage has been defaced:
https:\/\/web.archive.org\/web\/20240409020908\/https:\/\/moscollector.ru\/
– Took over their Facebook:
[Blackjack Was Here](https:\/\/ruexfil.com\/mos\/takedown\/facebook_blackjack-was-here.png)
,
[Slava Ukraini](https:\/\/ruexfil.com\/mos\/takedown\/facebook_ukraine.png)
– Disabled 566 of their
[SIM cards](https:\/\/ruexfil.com\/mos\/takedown\/phone-sims-disabled.png)
\/
[phones](https:\/\/ruexfil.com\/mos\/takedown\/phone-sims-disabled2.png)
.
– Data published at
[https:\/\/ruexfil.com\/mos\/takedown](https:\/\/ruexfil.com\/mos\/takedown\/)
.<\/p>\n
Sent with [Proton Mail](https:\/\/proton.me\/) secure email.<\/p>\n","protected":false},"excerpt":{"rendered":"
MOSCOLLECTOR TAKEDOWN – 9th of April 2024————————————————————— Russia’s Industrial Sensor and Monitoring Infrastructure has been disabled:[moscollector.ru](https:\/\/www.moscollector.ru\/)Hacked data is available at[https:\/\/ruexfil.com\/mos](https:\/\/ruexfil.com\/mos\/)It includes Russia’s Network Operation Center (NOC) to monitors and control Gas, Water, Firealarmand many others, including a vast network of remote sensors and IoT controllers. A total of 87,000sensors have been disabled. Milestones:– Initial access …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56200","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56200"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56200\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}