index.md

Compromised devices

Create a query to find hosts which hostname equals to HACKED-ROUTER-HELP-SOS-DEFAULT-PASSWORD.

Background

According to the news by BleepingComputer, there was a campaign which attacks routers. The compromised routers were changed its hostname to HACKED-ROUTER-HELP-SOS-DEFAULT-PASSWORD, etc.

• Tens of Thousands of Defaced MikroTik and Ubiquiti Routers Available Online (2018)

Unfortunately still you can find them on the Internet.

Hints

• There is no need to use a filter.
• You can make a free-text search when not specifying a filter.
  • e.g.
    • "X-Recruiting"
    • "X-Hacker"

---

• Answer