Finding

[Floyd_Jackson]

Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

Issue abstract:
Trojan Found
Detailed description:
My Threat protection found the following Trojan “ET WORM TheMoon.linksys.router 1”
Norton 360 did not show this event or blocked it.
is this Signature covered ?

Product & version number:
Norton 360
OS details:
MacOs Sequoia
What is the error message you are seeing?
ET WORM TheMoon.linksys.router 1
If you have any supporting screenshots, please add them:

[bjm]

@Floyd_Jackson

MacOs Sequoia
My Threat protection found the following Trojan “ET WORM TheMoon.linksys.router 1”
Norton 360 did not show this event or blocked it.
is this Signature covered ?

“My Threat protection” ?

When XProtect detects known malware, the software is blocked and the user is notified and given the option to move the software to the Trash. (source here)

What’s unusual about the worm, which has been dubbed “The Moon”, is that it doesn’t infect computers. In fact, it never gets as far as your computer.

And that means up-to-date anti-virus software running on your computer isn’t going to stop it. The worm never reaches a device which has anti-virus protection running on it.

And it also means that the worm doesn’t care whether your computer is running Windows, Mac OS X, or a flavour of Unix. It’s irrelevant. Your LinkSys router could still be at risk. (2014 source here)

‘The Moon’ worm infects Linksys routers 2014 [here]

Caveat: I’m not Mac

[Floyd_Jackson]

Thank you for the rapid response, I have no ideal how this was installed on my Client but my Dream machine pro found it. Never the less Thx no more worries

[bjm]

@Floyd_Jackson

Dream machine pro

https://store.ui.com/us/en/products/udm-pro

[Dxcv]

Just go this notification on my Unifi device this morning and was able to replicate it on demand.

Norton’s Network scan is triggering it.

The threat signature is a device trying to expoit port 8080 on your router. Norton replicates this when checking network security.

IDS/IPS on the Unifi device blocks this check from Norton as it matches the threat signature of TheMoon worm.

Annoying but thankfully a false positive