TF-MAL-elf.avrecon
📛 Threat Title
Malware family: AVrecon
Description
ThreatFox malware family `elf.avrecon`. Printable name: AVrecon.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.avrecon
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.avrecon
IOC database
- Type
- domain
- Value
elf.avrecon- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.avrecon
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.avrecon
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:bgr.com
The FBI just named 18 popular routers from D-Link, Netgear, TP-Link, and Zyxel that were targeted by a massive malware operation spanning over 160 countries.
-
web:infosecbulletin.com
The FBI has observed a type of malware named AVrecon , which was used to target many network devices around the world. The malware has a flexible design, allowing new attack tools to be added when new weaknesses are found. This increases the number of devices it can infect. The FBI found about 1,200 targeted device types from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.
-
web:malpedia.caad.fkie.fraunhofer.de
The malware is distributed via exploitation of unpatched vulnerabilities or common misconfiguration of the targeted devices. Once deployed, AVreckon will collect some information about the infected device, open a session to pre-configured C&C server, and spawn a remote shell for command execution.
-
web:thecyberexpress.com
The persistence mechanism AVrecon uses on some device models makes remediation particularly difficult. On vulnerable targets, the attackers use the device's own built-in firmware update feature to flash a custom firmware image that contains a hardcoded copy of AVrecon and silently disables the device's future update and re-flashing ...
-
web:www.fbi.gov
Threat actors have been found to compromise routers, install AVrecon malware , and then sell access to the compromised devices as residential proxies using the SocksEscort residential proxy service.
-
web:www.hstoday.us
Threat actors have been found to compromise routers, install AVrecon malware , and then sell access to the compromised devices as residential proxies using the SocksEscort residential proxy service. SocksEscort is believed to have compromised and sold access to approximately 369,000 devices since 2020.
-
web:www.ic3.gov
Threat actors have been found to compromise routers, install AVrecon malware , and then sell access to the compromised devices as residential proxies using the SocksEscort residential proxy service.
-
web:www.msn.com
The FBI released a flash alert on March 12, 2026, warning that thousands of older Wi‑Fi routers across the United States have been infected with AVrecon malware and quietly converted into ...
-
web:www.newsbreak.com
The FBI released a flash alert on March 12, 2026, warning that thousands of older Wi‑Fi routers across the United States have been infected with AVrecon malware and quietly converted into residential proxy nodes for criminal networks. The alert follows a federal takedown of a global proxy service that exploited end‑of‑life networking hardware to defraud U.S. individuals, businesses, and ...
-
web:www.slashgear.com
The FBI warns that AVrecon malware is infecting older routers. Discover if your D-Link, Netgear, TP-Link, or Zyxel device is compromised.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.