MOSCOLLECTOR TAKEDOWN - 9th of April 2024 --------------------------------------------------------------- Russia's Industrial Sensor and Monitoring Infrastructure has been disabled: [moscollector.ru](https://www.moscollector.ru/) Hacked data is available at [https://ruexfil.com/mos](https://ruexfil.com/mos/) It includes Russia's Network Operation Center (NOC) to monitors and control Gas, Water, Firealarm and many others, including a vast network of remote sensors and IoT controllers. A total of 87,000 sensors have been disabled. Milestones: - Initial access June 2023. - Access to [112 Emergency Service](https://ruexfil.com/mos/takedown/112-emergency-service.png) . - 87,000 [sensors](https://ruexfil.com/mos/takedown/sensors) and controls have been disabled (including Airports, subways, gas-pipelines, ...). - [Fuxnet](https://ruexfil.com/mos/takedown/fuxnet/) (stuxnet on steroids) was deployed earlier to slowly and physically destroy sensory equipment (by NAND/SSD exhaustion and introducing bad CRC into the firmware). - Fuxnet has now started to flood the RS485/MBus and is sending 'random' commands to 87,000 embedded control and sensory systems (carefully excluding hospitals, airports, ...and other civilian targets). - All servers have been deleted. All routers have been reset to factory reset. Most workstations (including the admins workstations) have been [deleted](https://ruexfil.com/mos/takedown/) . - Access to the office building has been disabled (all key-cards have been invalidated). - Moscollector has recently been [certified by the FSB](https://ruexfil.com/mos/takedown/FSB/fsb-certifies-mos.jpg) for being 'secure & trusted' (picture included) - Defaced the webpage (https://web.archive.org/web/20240409020908/https://moscollector.ru/) The media pack, screenshots and videos are available here: [https://ruexfil.com/mos/takedown](https://ruexfil.com/mos/takedown/) ( [.onion](http://cnqdc7cn4y5t6l5mxmyhwrp6wbneialihcdidc6a6ctdcrhktzmdbiqd.onion/) ) It contains: - GPS coordinates of all 87,000 sensors - Database of their internal and [secure Messaging](https://ruexfil.com/mos/takedown/dumps/) Platform (Dialog; used by Moscollector employees). - Screenshots of the Network Operation Centre - Screenshots of servers, routers, databases, ... - Screenshots of maps, blueprints of buildings, ... etc etc - Screenshots accessing their domain registrar - Screenshots of FuxNet source code and mode of operation - Video of FuxNet deploying and disabling the sensors The Op was conducted by BlackJack. --- After takedown report - About 1,700 sensor routers were destroyed. The central command-dispatcher and DataBase has been destroyed. => All 87,000 [sensors are offline](https://ruexfil.com/mos/takedown/fuxnet/) - Key-cards to enter the office and server rooms have been invalidated - All databases have been [wiped](https://ruexfil.com/mos/takedown/) . - All mail has been [wiped](https://ruexfil.com/mos/takedown/) . - A total of 30TB of data has been wiped. Including the backup drives. - Zabbix and other internal staging and monitoring servers have been wiped. - All admin workstations and most user workstations have been wiped. - Exhausted the corporate credit card. - Took control of their [domain](https://ruexfil.com/mos/takedown/domain/we-now-own-their-domain.png) "moscollector.ru". => Our server stats: [WEB Traffic](https://ruexfil.com/mos/takedown/domain/domain-stolen-traffic.png) , [Email Traffic](https://ruexfil.com/mos/takedown/domain/domain-stolen-emails.png) - Took down their [Firewall](https://ruexfil.com/mos/takedown/takedown_firewall.png) and disabled their Internet. - Webpage has been defaced: https://web.archive.org/web/20240409020908/https://moscollector.ru/ - Took over their Facebook: [Blackjack Was Here](https://ruexfil.com/mos/takedown/facebook_blackjack-was-here.png) , [Slava Ukraini](https://ruexfil.com/mos/takedown/facebook_ukraine.png) - Disabled 566 of their [SIM cards](https://ruexfil.com/mos/takedown/phone-sims-disabled.png) / [phones](https://ruexfil.com/mos/takedown/phone-sims-disabled2.png) . - Data published at [https://ruexfil.com/mos/takedown](https://ruexfil.com/mos/takedown/) . Sent with [Proton Mail](https://proton.me/) secure email.