The Dark Side of TheMoon

The talk follows researchers from Lumen's Black Lotus Labs as they rediscover the Moon, a proxy botnet first seen in 2014 and disrupted in 2019. Analysis of a sample showed a multi-stage loader that decrypts its next stage, contacts hardcoded command servers, and downloads further payloads. Those payloads pointed to a separate proxy service called Faceless, which sold access to infected devices spread across many countries.

Netflow hunting and malware analysis showed the two networks were tightly linked. Most Moon bots began contacting Faceless servers within about two days, and nearly all Faceless command servers were built from Moon bots. The Faceless design kept users apart from exit nodes, used command servers dedicated to individual networks, and ran its own scanners and FTP servers to recruit newly vulnerable devices. Only about a quarter of its users came through hosted addresses, so most appeared to use their own connections, and the user base skewed toward countries often linked to fraud.

The team's August takedown removed about 70 percent of the bots and briefly knocked the service offline, but it returned at full strength within a day or two. The operators supplied new bots, likely from mobile gateways, and set up a new Moon command server in July. The speakers concluded that one network operator can only cut part of such a botnet, and that effective disruption needs many transit partners acting together. Defenders should expect proxy operators to rebuild quickly after a takedown.