Suspected Remote Access Trojan (RAT) On Router

YouTube creators have sure made the word "RAT" a household name.

If your router is infected (very real possibility) it's not called a RAT. I don't remember the name off hand but it's like a backdoor/stepping stone. What a hacker will do is that if you have a port open (usually due to the dumb ISP) they can scan it and see if it's vulnerable to new firmware code. I think it's small and in the bootloader.

Turn off UPnP.
Don't use port forwarding. Instead, use a service like ZeroTier One and the likes.
If you need port forwarding, learn how to use pfSense or OPNsense.
Change the default router username and password to something else.
Stay abreast of any and all router firmware updates. Many people pay homage to the Microsoft patch Tuesday god and never pay attention to the one big machine: a router or modem.
If you know how, use a third-party router firmware like Asus Merlin, DD-WRT and the likes. Keep it updated.


If you wanna help know if perhaps your router is infected, then take your external WAN IP and search at the following three websites. If Shodan or Census shows an open port you may have issues. But it is common for some ISPs to have an open port on their equipment. But then again, that open port can be used to infect your router if it's vulnerable.

Shodan Search Engine

Censys.io.

GreyNoise Visualizer (If you see activity here with your IP, contact your ISP and let them know ASAP)

(Same with the website) AlienVault - Open Threat Exchange

All in all, if you're that concerned about it, reflash the router per manufacturer's instructions. Or use that new router you talked about and keep its firmware updated.

And another. See anything here with your IP, contact your ISP ASAP. AbuseIPDB - IP address abuse reports - Making the Internet safer, one IP at a time

Edit-

All those "scanners" won't find jack. It's snake oil... You would need to dump the RAM as an image and study it...

bro67 said:

None of these tools are going to do anything with network hardware. As for your computer hardware, it is obvious that there is nothing nefarious going on.

I think this is the right assumption at this point.

You need to understand that sophisticated malware will not be detected by your run-of-the-mill anti-virus software. Especially if it's polymorphic.

flashh4 said:

You can run the Farbar program & the other Malware removal programs & send the reports to my email if you want, i use this email for computer clients that i clean who want their info kept quiet ! flashh4@hotmail.com

IMO, suggestions to take discussions outside the forum is frowned upon... as is self-promotion, particularly when you denigrate other forum contributors.

Hope this helps....

It's called pastebin and the likes...

Original poster here.
I got my new router but havn't used it yet. I will make sure UPNP is disabled and no port forwarding.
I find the programme Livetcpudpwatch useful this sometimes show connections to port 1900 are being made. Port 1900 is known for vulnerabilities and of no use to an average home user who just uses the computer for browsing etc.
The attached pic is from a 10 minute session