Home Resources Blog VPNFilter Router Malware Adds 7 New Network Exploitation Modules

VPNFilter Router Malware Adds 7 New Network Exploitation Modules

Admin Globaldots
28.09.2018
image 1 Min read

Security researchers have discovered even more dangerous capabilities in VPNFilter—the highly sophisticated multi-stage malware that infected 500,000 routers worldwide in May this year, making it much more widespread and sophisticated than earlier.

Attributed to Russia’s APT 28, also known as ‘Fancy Bear,’ VPNFilter is a malware platform designed to infect routers and network-attached storage devices from 75 brands including Linksys, MikroTik, Netgear, TP-Link, QNAP, ASUS, D-Link, Huawei, ZTE, Ubiquiti, and UPVEL.

In May, when VPNFilter infected half a million routers and NAS devices in 54 countries, the FBI seized a key command-and-control domain used by the malware and asked people to reboot their routers.

Unlike most other malware that targets routers, the first stage of the VPNFilter malware was designed to persist through a reboot, gaining a persistent foothold on the infected device and enabling the deployment of the second stage malware.

The second stage module of VPNFilter was not persistent, which was designed to download additional modules onto the infected routers. This module also contains a killswitch, where the malware deliberately kills itself, rendering the infected router useless.

The third stage of VPNFilter is comprised of modules designed to expand the capabilities of the second stage, like packet sniffer, communication over Tor anonymizing network, and exploit delivery to compromised devices via JavaScript injection.

Read more: The Hacker News

Read More

Inform every aspect of your product & business with CDN Monitoring
Monitoring, Logging & Observability
Snir Ambar, Head of AI & Innovation @ GlobalDots 22.09.22

Extract actionable real-time insights, optimize performance and identify issues before they become problems – by unlocking the hidden value of CDN logs! Get 14 days free access to all features right now.

Watch more
Cybersecurity takes center stage
DevOps as a Service
Artem Mescheryakov, Senior DevOps Engineer, GlobalDots 20.09.22

In recognition of National Coding Week, Geektime.com, a top media channel covering tech, startup, venture capital, internet, mobile, development and more – featured a guest post by Artem Mescheryakov, Senior DevOps Engineer at GlobalDots:  “National Coding Week is about learning the value and importance of digital skills as well as nurturing the increasingly important skill of coding. Developer shortages […]

Read more
A CISO’s Essential Guide to API Security
API Security
Admin Globaldots 15.09.22

Learn how to reduce the business risk of API attacks – and maximize the value of digital innovation.  APIs are the entry point to your organization’s most critical data and services. Their protection is crucial to reduce risks, maximize program value, and generate growth. In this guide, we take a close look at the special […]

Read more
Unlock Your Cloud Potential
Schedule a call with our experts. Discover new technology and get recommendations to improve your performance.
Book a Demo