VPNFilter Router Malware Adds 7 New Network Exploitation Modules

Security researchers have discovered even more dangerous capabilities in VPNFilter—the highly sophisticated multi-stage malware that infected 500,000 routers worldwide in May this year, making it much more widespread and sophisticated than earlier.

Attributed to Russia’s APT 28, also known as ‘Fancy Bear,’ VPNFilter is a malware platform designed to infect routers and network-attached storage devices from 75 brands including Linksys, MikroTik, Netgear, TP-Link, QNAP, ASUS, D-Link, Huawei, ZTE, Ubiquiti, and UPVEL.

How One AI-Driven Media Platform Cut EBS Costs for AWS ASGs by 48%

In May, when VPNFilter infected half a million routers and NAS devices in 54 countries, the FBI seized a key command-and-control domain used by the malware and asked people to reboot their routers.

Unlike most other malware that targets routers, the first stage of the VPNFilter malware was designed to persist through a reboot, gaining a persistent foothold on the infected device and enabling the deployment of the second stage malware.

The second stage module of VPNFilter was not persistent, which was designed to download additional modules onto the infected routers. This module also contains a killswitch, where the malware deliberately kills itself, rendering the infected router useless.

The third stage of VPNFilter is comprised of modules designed to expand the capabilities of the second stage, like packet sniffer, communication over Tor anonymizing network, and exploit delivery to compromised devices via JavaScript injection.

Read more: The Hacker News