Scary Malware 'VPNFilter' Infects Over 500,000 Routers Worldwide

A new and scary malware, now dubbed as VPNFilter, has been recently discovered and has infected more than 500,000 routers in at least 50 countries around the world.

Cisco's Talos Intelligence Group had been investigating the widespread cyber attack for months now following an intelligence report. According to Talos’ blog post, all agencies involved in the research for the VPNFilter have reasons to believe that the forces responsible are “likely state-sponsored or state-affiliated.”

Unlike in most cases, Talos revealed the information they have even though their research is yet to be completed to inform affected companies and their customers. So far, known infected devices belong to Linksys, MikroTik, NETGEAR, and TP-Link.

VPNFilter starts once an infected machine reboots. Talos added that this part alone already makes VPNFilter a unique multi-stage malware since reboots normally hinder this type of attacks from flourishing.

The researchers suggested that the reboot is actually a necessary step to “gain a persistent foothold” in carrying out the next stage of the attack. Meanwhile, the “stage 2” of VPNFilter, in some cases, has a self-destructive nature that can affect a device’s firmware and later make it “unusable” after a reboot.

Talos director Craig Williams also told CNET, "Quite anything is possible, this attack basically sets up a hidden network to allow an actor to attack the world from a stance that makes attribution quite difficult."

While Talos clarifies that they still need to absolutely verify their initial findings that this attack is likely aimed at Ukraine, the organization explained how they arrived with such hypothesis.

“We have also observed VPNFilter, a potentially destructive malware, actively infecting Ukrainian hosts at an alarming rate, utilizing a command and control (C2) infrastructure dedicated to that country,” Talos stated.

On the part of U.S. government agencies, the Federal Bureau of Investigation has already gained control of a network domain — via court order — that is believed to be used as one of the command and control servers for the attack. The said domain was reportedly owned by the Sofacy Group which is composed of hackers based in Russia.

“By seizing a domain used by malicious cyber actors in their botnet campaign, the FBI has taken a critical step in minimizing the impact of the malware attack,” FBI Assistant Director Scott Smith said in a statement.

While security patches are still unavailable, potentially affected customers are advised to execute a factory reset on their routers.