Over the course of the last several months, researchers have investigated an advanced persistent threat known as VPNFilter, which has already infected 500,000 devices across 50+ countries, specifically targeting home office networks (or places utilizing small office and home office devices) as well as network-access storage (NAS) devices. The threat is believed to be sponsored by or affiliated with a nation state, which generally leads to well-funded, well-executed persistent threats that are properly managed with a defined end-game.
Based on research recently released by Cisco Talos, the US Department of Justice is urging anyone who owns small office home office (SOHO) and NAS devices to reboot their devices immediately.
The VPNFilter malware operates via three unique stages, which are described below at a high level.
The malware connects to Command and Control (C2) center infrastructure in order to receive the current connection information for Stage 2 deployment. Stage 1 persists through a reboot with advanced development mechanisms only seen in the most sophisticated threats.
The malware gains capabilities to collect files, execute commands, exfiltrate data, and manage devices. Additionally, certain versions observed contain a self-destruct option that will render the device unusable. Potentially, this scenario would allow the threat actors to execute a self-destruct command taking down hundreds of thousands of home networks globally. Stage 2 functionality does not persist through a reboot; however, the device remains prone to reinfection.
The malware contains advanced modules acting as plug-ins for Stage 2 such as packet sniffing and credential theft. Additional modules are believed to be available to the malware, but not yet uncovered by researchers.
The end-state goal of the threat actors has yet to be determined, but the options for exploitation and destruction are many.
While the FBI recommends rebooting your device at a minimum, more comprehensive recommendations include a factory default reset and patching devices to the latest version.
The following list of devices are known to be affected at time of writing, but additional devices may be susceptible to VPNFilter penetration:
If you found this post valuable, you may also enjoy:
ConvergeOne's industry experts will teach you three critical steps toward combating ransomware on our upcoming webinar. The team will showcase how recent ransomware attacks have become so successful at breaking down the barriers of even the largest organizations and what you can do to avoid becoming a victim.