VPNFilter

Most of the targeted devices known to use default credentials and/or have known exploits, particularly for older versions.

Russian state-sponsored cyber actors have used common but effective tactics to gain access to target networks, including spearphishing, credential harvesting, brute force/password spray techniques, and known vulnerability exploitation

To destroy data on compromised devices, the wiper overwrites file contents with up to 0x40000 bytes of data or uses MEMGETINFO, MEMUNLOCK, MEMERASE, and MEMWRITEOOB input/output control (IOCTL) system calls.

VPNFilter managed to exploit various network devices and affected over 500 000 devices in at least 54 countries.

Most of the targeted devices known to use default credentials and/or have known exploits, particularly for older versions.

Modification of routing traffic rules

Stage 1 is focused on persistence and redundancy and can survive a reboot.

This limits the ability of this specific malware to become active again... prevent the malware from moving forward to its listening mode, which occurs in the third phase of the first stage.

Most of the targeted devices known to use default credentials and/or have known exploits, particularly for older versions.

both the Photobucket accounts and the toknowall.com domain were hosting images in which the IP address of the C2 server, used by the threat actor to issue instructions to the malware were hidden, disguised within the EXIF metadata of the image.

To keep important data within the malware confidential, the malicious code used encryption, implementing the RC4 encryption algorithm.

Most of the targeted devices known to use default credentials and/or have known exploits, particularly for older versions.

Stage 1 is focused on persistence and redundancy and can survive a reboot.

Modification of routing traffic rules

This limits the ability of this specific malware to become active again... prevent the malware from moving forward to its listening mode, which occurs in the third phase of the first stage.

VPNFilter is a multi-stage, modular platform with versatile capabilities to perform a wide range of operations, primarily espionage but also destructive attacks. The malware installs itself on network devices such as routers and NAS

One particular module contained functionality to identify and monitor Modbus network traffic, a protocol widely used in Industrial Control Systems. | the malware could modify the routing information and create custom destinations for certain traffic; redirecting traffic from the genuine destination to a separate system under the control of the attackers.

Clearly, capturing data, especially usernames and passwords, was one goal of the attack.

This limits the ability of this specific malware to become active again... prevent the malware from moving forward to its listening mode, which occurs in the third phase of the first stage.

The malware was capable of downgrading encrypted https connections to an unencrypted http connection, then saving that traffic for future collection.

One particular module contained functionality to identify and monitor Modbus network traffic, a protocol widely used in Industrial Control Systems. | the malware could modify the routing information and create custom destinations for certain traffic; redirecting traffic from the genuine destination to a separate system under the control of the attackers.

devices in over 100 countries are being scanned on ports 23, 80, 2000, and 8080, which are indicative of additional scanning for vulnerable Mikrotik and QNAP NAS devices.

The main malicious functions of these malicious payloads can be resumed in: System discovery and footprinting

Stage 2 contains data exfiltration, command execution, file collection, device management

One of the best ways to minimize potential infection from IoT-malware is to limit the number of exposures one has to the internet. This means, in most cases, disabling any remote management options in the configuration.

Also, disabling Universal Plug-and-Play (UPnP) if the option is available, as this setting might expose services to the internet without the awareness of their users.

Stage 2 contains the main payload and is capable of file collection, command execution, data exfiltration, and device management.

The malware was capable of downgrading encrypted https connections to an unencrypted http connection, then saving that traffic for future collection.

By March 2018, additional malware samples were discovered that also reached out to Photobucket, and used toknowall.com as a backup in case Photobucket was unavailable.

Although only 363 networks connected back to our sinkhole... These 363 networks can be taken over by anyone with an understanding of how the malware works.

Obfuscated multiple C2 callback failover (TOR, VPS, Geolocation)

Communication with obfuscated addresses via TOR

Ability to download and install additional payloads

Stage 2 contains the main payload and is capable of file collection, command execution, data exfiltration, and device management.

This malware is a Wiper that will erase all the data in a targeted system.

Mirai and VPNFilter have been associated with distributed denial of service attacks

These behaviors include deleting data, writing junk data on specific device paths, and rebooting devices.