VPNFilter
VPNFilter is a modular multi-stage malware platform targeting SOHO and enterprise routers and QNAP NAS devices. Public reporting cited in the content states it infected more than 500,000 devices worldwide, with affected vendors including Linksys, MikroTik, Netgear, TP-Link, and QNAP, and infections observed across dozens of countries with notable focus on Ukraine. Cisco Talos is credited with publicly revealing the malware. VPNFilter is not related to virtual private networks despite its name.
The malware is described as consisting of three payload stages. Stage 1 establishes boot persistence and survives device reboots. Stage 2 functions as a remote access trojan that enables command execution and data theft. Stage 3 consists of plugins that extend functionality. Reported capabilities across the stages and plugins include stealing files and information, inspecting and sniffing network traffic, man-in-the-middle interception, communication over Tor, monitoring SCADA/ICS traffic including Modbus on port 502, and a destructive capability that can wipe part of device firmware and render devices unusable. A destructive Stage 3 plugin named "dstr" is specifically referenced; later research found developmental similarities between this plugin and the AcidRain modem/router wiper.
The content associates VPNFilter with Russian state activity. Multiple cited sources say the FBI and U.S. Department of Justice attributed the 2018 VPNFilter campaign to the Russian government. Some reporting in the content attributes development to Sofacy/Fancy Bear/APT28/GRU Unit 26165, while other government and joint-advisory references state that GRU Unit 74455 (Sandworm) deployed VPNFilter against home and office routers worldwide in 2018 and describe Cyclops Blink as Sandworm’s apparent successor to VPNFilter. Because the content contains differing attribution references, the strongest high-confidence statement is that U.S. authorities attributed the 2018 campaign to the Russian government.
Operationally, the malware was discussed as a botnet used for large-scale compromise of networking devices, with concern that it could support disruptive operations against Ukrainian infrastructure and other targets. The FBI disrupted the botnet in 2018 through a court-authorized operation that seized a domain used for command and control, including ToKnowAll[.]com in one cited report. Rebooting affected devices was said to disrupt non-persistent Stage 2 and Stage 3 components, but not remove persistent Stage 1; factory reset, firmware updates, password changes, and disabling remote administration were recommended in cited reporting.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The most notable case is VPNFilter, a modular malware aimed at SOHO routers and QNAP storage devices, discovered by Talos.
The most notable case is VPNFilter, a modular malware aimed at SOHO routers and QNAP storage devices, discovered by Talos.
Techniques & procedures
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Resource Development
2 techniques
Resource Development
Initial Access
3 techniques
Initial Access
Most of the devices targeted are known to use default credentials and/or have known exploits, particularly for older versions.
Execution
1 technique
Execution
Persistence
5 techniques
Persistence
The first-stage payload can achieve boot persistence on devices and survive reboot operations
Most of the devices targeted are known to use default credentials and/or have known exploits, particularly for older versions.
Owners are advised to consider disabling remote-management settings on devices and secure with strong passwords and encryption when enabled.
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
2 techniques
Credential Access
Discovery
2 techniques
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
3 techniques
Collection
The malware is capable of collecting traffic sent through infected routers, such as website credentials.
Command and Control
5 techniques
Command and Control
The operation copied and removed malware from vulnerable internet-connected firewall devices that Sandworm used for command and control (C2) of the underlying botnet.
They could use the botnet's hacked devices to hide the source of other malicious attacks
Impact
5 techniques
Impact
Among its many plugins, it also included functionality to wipe and brick devices...
This renders any device unusable, as the code needed to start the device has been replaced with jumbled data.
Among its many plugins, it also included functionality to wipe and brick devices as well as DDoS a target.
This wiper iterates over all possible device file identifiers (e.g., mtdblock0 – mtdblock99), opens the device file, and either overwrites it with up to 0x40000 bytes of data or (in the case of the /dev/mtd* device file) uses the following IOCTLS to erase it: MEMGETINFO, MEMUNLOCK, MEMERASE, and MEMWRITEOOB.
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A router-targeting botnet used to communicate with infected routers.
Malware infecting home routers at scale; described here as compromising large numbers of routers.
A botnet listed among notable prior takedowns involving compromised networking devices.
Earlier Sandworm malware on network devices referenced as the predecessor replaced by Cyclops Blink.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.