Loading story…
Cisco Talos and subsequent government advisories reported that VPNFilter compromised at least 500,000 small-office/home-office routers and QNAP NAS devices across 54 countries, using a modular malware framework linked by researchers to infrastructure and code patterns associated with earlier Ukraine-focused activity. The campaign targeted older devices from vendors including Linksys, MikroTik, Netgear, TP-Link, and QNAP, likely through known public vulnerabilities and default credentials rather than zero-days, and showed notable concentration in Ukraine alongside scanning on ports 23, 80, 2000, and 8080.
VPNFilter operates in multiple stages: a persistent Stage 1 loader that survives reboot and locates command-and-control infrastructure, a Stage 2 payload that enables command execution, file collection, traffic interception, data exfiltration, and device destruction, and Stage 3 plugins that add capabilities such as packet sniffing and covert communications over Tor. Researchers warned that the malware could manipulate browsing sessions and permanently disable devices by overwriting firmware and rebooting them, prompting recommendations to factory reset and reboot affected devices, patch firmware, change default credentials, and disable remote management to remove non-persistent components and reduce the risk of destructive action.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Talos reported another substantial increase in newly acquired VPNFilter victims focused in Ukraine on May 17. The activity reinforced Talos's assessment that Ukraine was a major focus of the campaign.
Talos observed a sharp spike in newly infected VPNFilter victims on May 8, with almost all of the new victims located in Ukraine. Many of the Ukrainian infections used a separate Stage 2 command-and-control infrastructure.
Cisco Talos said the VPNFilter malware framework had been quietly growing since at least 2016, targeting SOHO networking equipment and QNAP NAS devices. Talos assessed the malware as likely operated by a state-sponsored or state-affiliated actor.
Cisco Talos publicly reported the VPNFilter malware framework, estimating at least 500,000 infected devices across at least 54 countries. Talos described its multi-stage architecture, espionage and destructive capabilities, code overlap with BlackEnergy, and released detection signatures and mitigation guidance.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and private-sector researchers disrupted **VPNFilter**, a large botnet that had infected more than **500,000** small-office and home-office routers and network-attached storage devices in at least **54 countries**. The Justice Department announced action against the botnet after Cisco Talos exposed the malware, and the FBI seized command-and-control infrastructure to cut off attacker access. US-CERT warned that the malware targeted network infrastructure devices from multiple vendors and urged owners to reboot, patch, and secure affected equipment. Investigators described VPNFilter as a modular platform capable of credential theft, traffic interception, man-in-the-middle operations, **Tor**-based anonymization, industrial control system traffic monitoring, and rendering devices unusable. Analysis tied the campaign to **APT28**/**Sofacy**, a group associated with Russian intelligence, with code similarities and operational links reinforcing the attribution. Researchers said infection spikes in Ukraine suggested the operators may have been preparing a broader disruptive attack, but the coordinated law-enforcement and industry response interrupted the campaign before its most destructive capabilities were deployed.
Aug 15, 2026
Ransomware affiliates mounted a coordinated wave of attacks against internet-facing VPN and firewall appliances from **Palo Alto Networks, Fortinet, Check Point, and Citrix**, turning edge remote-access systems into a primary entry point for corporate intrusions. Reported campaigns included **FortiBleed** credential exposure on FortiGate devices, exploitation of Palo Alto GlobalProtect authentication bypass `CVE-2026-0257`, abuse of Check Point VPN authentication bypass `CVE-2026-50751`, and rapid exploitation of Citrix NetScaler memory-disclosure flaw `CVE-2026-8451`. Security reporting linked **Qilin** affiliates to at least the Palo Alto and Check Point activity, with exploitation beginning within days—and in some cases less than 24 hours—after disclosure or proof-of-concept release. After gaining access, attackers were reported using lateral movement and credential-theft techniques including **Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI**, Chrome credential theft via GPO, and **WSL-based EDR evasion**, followed by data theft and double-extortion ransomware deployment. Victims were concentrated in the United States, United Kingdom, Australia, and Western Europe across healthcare, education, manufacturing, local government, media, professional services, and critical infrastructure. The surge prompted Sen. **Ron Wyden** to call for a federal purge of legacy, public-facing VPNs, urging **OMB, CISA, and NIST** to push agencies toward zero-trust remote access and away from perimeter-based systems repeatedly exposed by incidents involving Fortinet, Check Point, Ivanti, and Cisco platforms.
Jul 27, 2026
Researchers reported multiple campaigns compromising internet-facing edge devices, with **ASUS routers** and **Cisco Small Business/SOHO routers** heavily targeted to build stealthy botnets and relay infrastructure. GreyNoise and Censys tracked the **AyySSHush** campaign abusing legitimate ASUS firmware features, older authentication bypass paths, and `CVE-2023-39780` to enable logging functions, add attacker SSH keys, and expose backdoor access on **TCP/53282**; Censys identified **4,504 likely compromised ASUS devices** as of late May, after counts had previously surged above **10,000**. Sekoia separately observed a May campaign against ASUS routers using `CVE-2021-32030` to enable SSH on the same port, with more than **9,500 potentially affected devices**. At the same time, Sekoia detailed **PolarEdge** and **ViciousTrap**, campaigns exploiting `CVE-2023-20118` in Cisco routers and extending to devices from **QNAP, Synology, and ASUS**. PolarEdge used webshells and encrypted TLS backdoors to create an **Operational Relay Box** network of more than **2,000 devices**, while ViciousTrap installed NAT redirection rules to turn compromised systems into a distributed interception layer that forwarded inbound traffic to attacker-controlled servers; Sekoia counted **over 5,000 compromised devices** across many countries. Investigators also found overlap between the ASUS activity and infrastructure tied to ViciousTrap, suggesting at least some operators are reusing tooling and access across edge-device botnet operations, with residential ISP exposure indicating likely use for proxying, relays, or follow-on cyber activity.
Aug 15, 2026