VPNFilter Evolving to Be a More Dangerous Threat

Malware writers are finding greater efficiencies by reusing older code families. That explains why VPNFilter — the attack that caused the FBI to recommend that everyone in the US reset their cable modem — is showing up with new capabilities and payloads.

In a new report, Talos says that its researchers have found seven new third-stage VPNFilter modules that add significant new functionality. The new capabilities include including an expanded ability to move laterally between endpoints on a network, data filtering, and multiple encrypted tunnels to mask command-and-control and data exfiltration traffic.

In the conclusion of the report, Talos offers information both worrying and soothing to security professionals. On the one hand, researchers list the new capabilities and point out that these are accompanied by new obfuscation routines, making it more difficult to find the more dangerous malware.

On the other hand, "it appears that VPNFilter has been entirely neutralized since we and our international coalition of partners (law enforcement, intelligence organizations, and the Cyber Threat Alliance) countered the threat earlier this year."

However, Talos cautions against becoming complacent. "[We] know that the actor behind VPNFilter is extremely capable and driven by their mission priorities to continually maneuver to achieve their goals," according to the report. "The sophisticated nature of this framework further illustrates the advanced capabilities of the threat actors making use of it, as well as the need for organizations to deploy robust defensive architectures to combat threats such as VPNFilter."

Read more here.

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.