VPNFilter Malware Can Also Steal Information, Bypass Encryption, According to New Research Findings

When the malware called VPNFilter was first made known to the public, ensuing announcements from security researchers and even the Federal Bureau of Investigation suggested that its effects had been contained following a shutdown of a domain linked to the malware's operations. Unfortunately, Cisco Talos recently learned that this is not completely the case.

Cisco Talos was the first to discover the spread of VPNFilter and that it targets Wi-Fi routers. The malware was initially thought to have the capacity to only destroy routers. However, new findings suggest that it also has the ability to steal people’s information by bypassing web encryptions.

In Cisco’s first report, it admitted that the information it had was just preliminary and that the study on VPNFilter may still develop. And so it did.

Cisco’s latest report said it discovered a new multi-stage module “that injects malicious content into web traffic as it passes through a network device.” This means that the attackers can put a malicious code on a victim’s network traffic without triggering an alert that would notify if his or her computer has been compromised.

“With this new finding, we can confirm that the threat goes beyond what the actor could do on the network device itself, and extends the threat into the networks that a compromised network device supports,” the researchers further explained.

The VPNFilter malware, it was learned, was designed to also bypass the SSL encryption commonly used on the web.

SSL, or Secure Socket Layers, ensures that all information that is passing through the network — from web servers to people’s browsers — will not leak and will remain secure. Unfortunately, traces were reportedly found that VPNFilter can work its way around this encryption, too.

In addition to the very scary effects of VPNFilter infection, security researchers also learned that Wi-Fi devices from more manufacturers have also been targeted by the malware. Cisco recently confirmed that routers from ASUS, D-Link, Huawei, Ubiquiti, UPVEL and ZTE are affected too.

Previously, routers made by Linksys, MikroTik, Netgear and TP-Link were found targeted by the VPNFilter actors.

Meanwhile, similar to Cisco’s initial findings, Symantec also concluded that the VPNFilter actors are specifically targeting computers and networks based in Ukraine, although infected machines were found in at least 54 countries. For this reason, researchers and authorities believe that this is a massive state-sponsored attack.