🛡️ 🚨 SECURITY ALERT — ACTIVE WORM ACTIVITY DETECTED ON INTERNAL NETWORK
BLUF: A device at 192.168.1.42 is exhibiting worm behavior consistent with TheMoon malware targeting Linksys routers. The attack was directed at the network gateway (192.168.1.1). The UDM-Pro IPS blocked the attempt. Immediate device isolation and investigation required. DETAILS IPS signature ET WORM TheMoon.linksys.router triggered on UDM-Pro; action taken was block — the attack did not reach the gateway Source device 192.168.1.42 initiated the connection on source port 5432 targeting the gateway at 192.168.1.1 TheMoon is a known worm that exploits vulnerabilities in Linksys (and similar SOHO) routers to propagate, execute unauthorized commands, and enlist devices into proxy botnets Direction logged as inbound to the UDM-Pro’s inspection engine — originating from inside the local network segment No additional context is available on the identity, type, or current state of the device at 192.168.1.42 — nature and extent of compromise on that host is unconfirmed IMPACT Affected: Device at 192.168.1.42 (identity unknown — investigate immediately); network gateway 192.168.1.1 Scope: Contained to local network segment at this time; IPS block prevented gateway exploitation Risk if unmitigated: Successful router compromise could enable traffic interception, DNS hijacking, lateral movement, or enrollment in a proxy botnet Unknown: Whether 192.168.1.42 has made additional outbound or lateral connections not captured by this alert; whether other internal hosts have been targeted RECOMMENDED ACTIONS Isolate 192.168.1.42 immediately — remove from network or apply a block rule at the UDM-Pro until the device is identified and assessed Identify the device — check DHCP leases, ARP tables, and UDM-Pro client lists to determine device type and owner Review IPS/firewall logs for any additional signatures or connections from 192.168.1.42, particularly outbound to known TheMoon C2 infrastructure Check the gateway (192.168.1.1) for signs of tampering — verify firmware integrity, admin credentials, and configuration Scan the network for additional devices exhibiting similar behavior; TheMoon is self-propagating and may have spread from another host Do not reconnect 192.168.1.42 until it has been fully reimaged or confirmed clean SOURCES UDM-Pro IPS Event Log — ET WORM TheMoon.linksys.router 1 Emerging Threats signature database (ET WORM ruleset) TheMoon worm — publicly documented threat (first observed 2014; variants active through present)