Cyber Threat Actor: Janitor

The threat actor known by the alias Janitor (also referenced as Janit0r) is identified as residing in Russia. He claims authorship of the IoT malware family BrickerBot, which targets unsecured internet‑of‑things devices such as Zyxel HN‑51 modems. According to his own statements, BrickerBot first attempts to harden a compromised device; if hardening fails, it erases the device’s flash storage and overwrites it with random data, rendering the hardware inoperable. This behavior indicates a disruptive objective rather than financial gain or espionage. The actor notes that he created BrickerBot to compete with other IoT malware families that pursue similar hardware, suggesting a focus on contention over device control. His public comments emphasize that ISPs should restrict wide‑area‑network access to device management interfaces, particularly TR‑069, which he identifies as a common initial‑access vector for BrickerBot and related threats.

In April 2017, Janitor alerted Bleeping Computer that BrickerBot was present on the network of Californian ISP Sierra Tel during a widespread outage that knocked Zyxel HN‑51 modems offline for customers in Mariposa and Oakhurst. He noted that the disruption persisted for almost two weeks before Sierra Tel reported that repairs were completed. He acknowledged that the outage could also involve concurrent activity from the Mirai malware, citing a prior Mirai variant that disrupted Deutsche Telekom and British ISPs. In his correspondence, Janitor expressed concern that Sierra Tel was receiving unfair negative publicity for being transparent about the incident. He also reiterated that the ISP should have filtered wide‑area‑network access to device management interfaces to prevent such compromise. Janitor has not been linked to any state sponsor or criminal consortium in the available reporting. Security firm Radware later reported discovering updated versions of BrickerBot with altered bricking techniques, which the actor has not publicly disputed. No further campaigns or operational details are attributed to him in the source material.