VPNFilter Evolving to Be a More Dangerous ThreatVPNFilter Evolving to Be a More Dangerous Threat
VPNFilter malware is adding capabilities to become a more fully-featured tool for threat actors.
September 27, 2018
Malware writers are finding greater efficiencies by reusing older code families. That explains why VPNFilter — the attack that caused the FBI to recommend that everyone in the US reset their cable modem — is showing up with new capabilities and payloads.
In a new report, Talos says that its researchers have found seven new third-stage VPNFilter modules that add significant new functionality. The new capabilities include including an expanded ability to move laterally between endpoints on a network, data filtering, and multiple encrypted tunnels to mask command-and-control and data exfiltration traffic.
In the conclusion of the report, Talos offers information both worrying and soothing to security professionals. On the one hand, researchers list the new capabilities and point out that these are accompanied by new obfuscation routines, making it more difficult to find the more dangerous malware.
On the other hand, "it appears that VPNFilter has been entirely neutralized since we and our international coalition of partners (law enforcement, intelligence organizations, and the Cyber Threat Alliance) countered the threat earlier this year."
However, Talos cautions against becoming complacent. "[We] know that the actor behind VPNFilter is extremely capable and driven by their mission priorities to continually maneuver to achieve their goals," according to the report. "The sophisticated nature of this framework further illustrates the advanced capabilities of the threat actors making use of it, as well as the need for organizations to deploy robust defensive architectures to combat threats such as VPNFilter."
Read more here.
Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingDec 12, 2023
SecOps & DevSecOps in the CloudDec 14, 2023
What's In Your Cloud?Jan 17, 2024
Everything You Need to Know About DNS AttacksJan 18, 2024
How to Deploy Zero Trust for Remote Workforce Security
What Ransomware Groups Look for in Enterprise Victims
How to Use Threat Intelligence to Mitigate Third-Party Risk
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Gone Phishing: How to Defend Against Persistent Phishing Attempts Targeting Your Organization
2022 Insurance Industry Cyber Threat Landscape Report
Protecting Critical Infrastructure: The 2021 Energy, Utilities, and Industrials Cyber Threat Landscape Report