VPNFilter Malware Which Infected 500,000 Devices is Worse Than First Thought

  • 284
  •  
  •  
  •  
  • 2
  •  
  •  
  •  
    286
    Shares

VPNFilter malware which has affected over half million devices and Network Attached Storage devices spanning 54 countries during the past few months has now taken a new turn courtesy of research from Cisco.

The report shows a sharp increase in the number of devices affected compared with the original. Researchers have also found additional VPNFilter capabilities which were packaged as the third stage plugin in the deployment system.

ssler – plugin for intercepting and modifying web traffic on port 80 via man-in-the-middle attacks. Plugin also supports downgrading HTTPS to HTTP.

dstr – plugin to overwriting device firmware files. Cisco knew VPNFilter could wipe device firmware, but in its recent report pinpointed this function to this specific third-stage plugin.

ps – plugin that can sniff network packets and detect certain types of network traffic. Cisco believes this plugin was used to look for Modbus TCP/IP packets, often used by industrial software and SCADA equipment, but in its most recent report claims the plugin will also look for industrial equipment that connects over TP-Link R600 virtual private networks as well.

tor – plugin used by VPNFilter bots to communicate with a command and control server via the Tor network.

The Technical documentation of the malware has been updated since Cisco’s first report, now including information about ssler, dstr, and the ps third-stage plugins. The botnet was first thought to be aimed at Ukraine’s IT infrastructure, however many experts believe that the cyber attack was meant for the UEFA Champion League Soccer final which was held at the end of  last month. The FBI have also taken steps to kill the botnet by removing the command and the control element of the malware.

Take your time to comment on this article.

The following two tabs change content below.
I am a programmer and tech enthusiast who loves to use my creative skills to solve complex problems. I also love to stay abreast of what is happening in the world of technology, reach me at: [email protected]

Harikrishna Mekala

I am a programmer and tech enthusiast who loves to use my creative skills to solve complex problems. I also love to stay abreast of what is happening in the world of technology, reach me at: [email protected]

Leave a Reply

Do NOT follow this link or you will be banned from the site!