Skip to Main Content

VPNFilter Malware Campaign Infecting Half a Million Network Devices

On Wednesday, May 23rd, the Cisco Talos team released details about a malware campaign dubbed "VPNFilter," with an estimated number of infected network devices to be over half a million. The exact exploitation method for devices is unknown, however Talos suspects that the malware is exploiting well know vulnerabilities within these devices. Once a device is exploited, it can be used to eavesdrop on traffic, steal website credentials, and it can be rendered unusable. As of this writing, the team listed out the following device types as being targeted, noting that it is highly likely that this list will grow:

 

  1. Asus Devices:
    1. RT-AC66U (new)
    2. RT-N10 (new)
    3. RT-N10E (new)
    4. RT-N10U (new)
    5. RT-N56U (new)
    6. RT-N66U (new)
  2. D-Link Devices:
    1. DES-1210-08P (new)
    2. DIR-300 (new)
    3. DIR-300A (new)
    4. DSR-250N (new)
    5. DSR-500N (new)
    6. DSR-1000 (new)
    7. DSR-1000N (new)
  3. Huawei Devices:
    1. HG8245 (new)
  4. Linksys Devices:
    1. E1200
    2. E2500
    3. E3000 (new)
    4. E3200 (new)
    5. E4200 (new)
    6. RV082 (new)
    7. WRVS4400N
  5. Mikrotik RouterOS Versions for Cloud Core Routers:
    1. CCR1009 (new)
    2. CCR1016
    3. CCR1036
    4. CCR1072
    5. CRS109 (new)
    6. CRS112 (new)
    7. CRS125 (new)
    8. RB411 (new)
    9. RB450 (new)
    10. RB750 (new)
    11. RB911 (new)
    12. RB921 (new)
    13. RB941 (new)
    14. RB951 (new)
    15. RB952 (new)
    16. RB960 (new)
    17. RB962 (new)
    18. RB1100 (new)
    19. RB1200 (new)
    20. RB2011 (new)
    21. RB3011 (new)
    22. RB Groove (new)
    23. RB Omnitik (new)
    24. STX5 (new)
  6. Netgear Devices:
    1. DG834 (new)
    2. DGN1000 (new)
    3. DGN2200
    4. DGN3500 (new)
    5. FVS318N (new)
    6. MBRN3000 (new)
    7. R6400
    8. R7000
    9. R8000
    10. WNR1000
    11. WNR2000
    12. WNR2200 (new)
    13. WNR4000 (new)
    14. WNDR3700 (new)
    15. WNDR4000 (new)
    16. WNDR4300 (new)
    17. WNDR4300-TN (new)
    18. UTM50 (new)
  7. QNAP Devices:
    1. TS251
    2. TS439 Pro
    3. Other QNAP NAS devices running QTS software
  8. TP-Link Devices:
    1.  R600VPN
    2. TL-WR741ND (new)
    3. TL-WR841N (new)
  9. Ubiquiti Devices:
    1. NSM2 (new)
    2. PBE M5 (new)
  10. Upvel Devices:
    1. Unknown Models – unable to determine specific device (new)
  11. ZTE Devices:
    1. ZXHN H108N (new)

For more information about the  campaign and the up-to-date list of affected devices, visit https://blog.talosintelligence.com/2018/05/VPNFilter.html.

The IT Security Office recommends that as a first priority, users visit the campaign website and determine whether a device they own is on the list of affected devices; if so, they should ensure the device is up-to-date on patches/firmware, and if not, they should restart the device and update it as soon as reasonably possible. They should also segregate and secure these devices to only allow authorized and required network traffic to and from them. Due to the broad scope of additional possibly affected devices, users should ensure that other network devices under their purview are also recent on patches and secured as mentioned above.

 

 

Tags
Vulnerability