Loading story…
U.S. authorities and private-sector researchers disrupted VPNFilter, a large botnet that had infected more than 500,000 small-office and home-office routers and network-attached storage devices in at least 54 countries. The Justice Department announced action against the botnet after Cisco Talos exposed the malware, and the FBI seized command-and-control infrastructure to cut off attacker access. US-CERT warned that the malware targeted network infrastructure devices from multiple vendors and urged owners to reboot, patch, and secure affected equipment.
Investigators described VPNFilter as a modular platform capable of credential theft, traffic interception, man-in-the-middle operations, Tor-based anonymization, industrial control system traffic monitoring, and rendering devices unusable. Analysis tied the campaign to APT28/Sofacy, a group associated with Russian intelligence, with code similarities and operational links reinforcing the attribution. Researchers said infection spikes in Ukraine suggested the operators may have been preparing a broader disruptive attack, but the coordinated law-enforcement and industry response interrupted the campaign before its most destructive capabilities were deployed.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
Trend Micro said it worked with Shadowserver to upgrade the VPNFilter second-stage sinkhole using a valid image so infected devices would not progress into listening mode. The article also reported that 363 networks connected back to the sinkhole and 1,801 networks initially responded positively, indicating infections likely persisted years after the 2018 disruption.
On May 23, 2018, the Justice Department announced actions to disrupt the APT28 botnet of infected routers and network storage devices. According to Talos, the FBI seized the attackers' command-and-control infrastructure, preventing commands from being broadcast to compromised devices.
Cisco Talos disclosed the VPNFilter malware campaign on May 23, 2018, describing a sophisticated operation that had infected more than 500,000 routers and network-attached devices across at least 54 countries.
Sharp spikes in VPNFilter infections were observed on May 8 and May 17, 2018, with the sudden growth occurring almost exclusively in Ukraine.
By March 2018, additional VPNFilter malware samples were found that contacted Photobucket and used toknowall.com as a backup communication channel.
By the end of August 2017, the FBI had been alerted to a home router showing unusual behavior linked to malware infection. The device attempted to connect to a Photobucket account to retrieve an image used in the malware's communications chain.
On May 4, 2017, toknowall.com was changed from a Bulgarian hosting provider to an IP address hosted in France.
A domain later identified as part of VPNFilter's command-and-control mechanism, toknowall.com, was registered in December 2015.
Analysis of reused RC4 code, including an implementation flaw matching BlackEnergy malware, helped government agencies attribute VPNFilter to APT28/Sofacy, a group associated with Russian intelligence services.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourceblog.talosintelligence.com
Open sourcejustice.gov
Open sourceus-cert.gov
Open sourceus-cert.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos and subsequent government advisories reported that **VPNFilter** compromised at least **500,000** small-office/home-office routers and QNAP NAS devices across **54 countries**, using a modular malware framework linked by researchers to infrastructure and code patterns associated with earlier Ukraine-focused activity. The campaign targeted older devices from vendors including **Linksys, MikroTik, Netgear, TP-Link, and QNAP**, likely through known public vulnerabilities and default credentials rather than zero-days, and showed notable concentration in Ukraine alongside scanning on ports `23`, `80`, `2000`, and `8080`. VPNFilter operates in multiple stages: a persistent **Stage 1** loader that survives reboot and locates command-and-control infrastructure, a **Stage 2** payload that enables command execution, file collection, traffic interception, data exfiltration, and device destruction, and **Stage 3** plugins that add capabilities such as packet sniffing and covert communications over **Tor**. Researchers warned that the malware could manipulate browsing sessions and permanently disable devices by overwriting firmware and rebooting them, prompting recommendations to **factory reset and reboot affected devices, patch firmware, change default credentials, and disable remote management** to remove non-persistent components and reduce the risk of destructive action.
Aug 8, 2026
The FBI and Justice Department said they disrupted multiple Russian GRU operations that hijacked small office/home office routers to conceal espionage activity, proxy malicious traffic, and steal credentials. In one court-authorized action, **Operation Dying Ember**, agents remotely accessed hundreds of compromised **Ubiquiti EdgeOS** routers infected with **Moobot**, deleted malware and related files, and temporarily changed firewall rules to cut off **APT28**—also tracked as **Fancy Bear**, **Sednit**, and **Forest Blizzard**—without disrupting normal device use. Officials said the botnet had originally been built by cybercriminals abusing internet-exposed routers with default administrator passwords before being repurposed by Russia’s **GRU Unit 26165**. U.S. authorities later said a related GRU campaign also compromised SOHO routers, including **TP-Link** devices, to alter **DNS** settings and conduct adversary-in-the-middle attacks against **TLS** sessions, including Outlook traffic, in operations affecting government, IT, telecommunications, and energy targets. In **Operation Masquerade**, the FBI sent commands to infected routers to collect forensic data and reset malicious DNS configurations, removing Russian access from the devices. Microsoft and U.S. agencies linked the activity to APT28 and warned that router compromises can enable traffic redirection, credential theft, malware delivery, and denial-of-service attacks, urging organizations to patch firmware, verify DNS settings, disable unnecessary remote management, and replace end-of-life hardware.
Jun 29, 2026
The U.S. Department of Justice said a court-authorized FBI operation disrupted the **KV Botnet**, a network of hundreds of compromised small office and home office routers that the PRC-linked group **Volt Typhoon** used to mask follow-on intrusions against U.S. and foreign targets, including critical infrastructure. Officials said the botnet relied heavily on end-of-life **Cisco** and **NetGear** devices, and that the FBI removed malware from affected U.S.-based routers and severed communications with botnet controllers without disrupting legitimate router functions or collecting content. The government tied the activity to broader Chinese pre-positioning against sectors including communications, energy, transportation, and water, while warning that unsupported devices remain vulnerable to reinfection unless replaced or fully remediated. Reporting on the takedown said the action mirrored earlier U.S. botnet disruptions such as the 2022 operation against **Cyclops Blink**, the **Sandworm/GRU** botnet that abused WatchGuard and ASUS devices as command-and-control infrastructure. Subsequent research from Censys found that KV Botnet control infrastructure evolved after the December 2023 disruption, with operators in the **JDY** cluster largely retaining the same infrastructure patterns while shifting hosting providers and continuing activity linked to vulnerable `Cisco RV320/RV325` routers. The researchers said the botnet’s comparatively exposed infrastructure did not fully match Volt Typhoon’s usual stealthy tradecraft, raising questions about whether the KV Botnet was operated directly by Volt Typhoon or by a separate but related actor.
Jun 29, 2026