Estimated 500,000 routers infected with VPNfilter Malware

[Troopy_03]

Did a search and didn't see any other mention, apart from a 6 year old thread on a similar thing.
https://www.cnet.com/news/us-takes-aim-at-russian-hackers-who-infected-over-500000-routers/

Very interesting report.

[D4D]

Interesting, if it is the same vuln I think it is, Cisco quietly released an update for this a few months ago.

[bodgie]

Cisco identified this malware, info is available here:

https://blog.talosintelligence.com/2018/05/VPNFilter.html

Some key extracts from this report:

The known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices. No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues.

Lastly, the malware has a destructive capability that can render an infected device unusable, which can be triggered on individual victim machines or en masse, and has the potential of cutting off internet access for hundreds of thousands of victims worldwide.

The type of devices targeted by this actor are difficult to defend. They are frequently on the perimeter of the network, with no intrusion protection system (IPS) in place, and typically do not have an available host-based protection system such as an anti-virus (AV) package.

We are unsure of the particular exploit used in any given case, but most devices targeted, particularly in older versions, have known public exploits or default credentials that make compromise relatively straightforward. All of this has contributed to the quiet growth of this threat since at least 2016.

If you have an impacted device from Linksys, Netgear or TP-Link or Mikrotik (which isn't very common in Oz) router I'd be checking for an update from the manufacturers website to see if they have a fix for your router/modem.

If the device is more than 2 years old, I'd be very doubtful there will be an update. Unfortunately this will mean that you're router is vulnerable and possibly infected.

Best advice I can offer is to not use old and unsupported (no updates available) IT equipment as it is becoming increasingly risky to both you, and other users of the Internet.