Attributed to Russia's APT 28, also known equally 'Fancy Bear,' VPNFilter is a malware platform designed to infect routers together with network-attached storage devices from 75 brands including Linksys, MikroTik, Netgear, TP-Link, QNAP, ASUS, D-Link, Huawei, ZTE, Ubiquiti, together with UPVEL.
In May, when VPNFilter infected one-half a 1000000 routers together with NAS devices inwards 54 countries, the FBI seized a substitution command-and-control domain used yesteryear the malware together with asked people to reboot their routers.
Initially, it was found that VPNFilter had been built amongst multiple assault modules that could last deployed to the infected routers to steal website credentials together with monitor industrial controls or SCADA systems, such equally those used inwards electrical grids, other infrastructure together with factories.
However, inwards a novel study published yesteryear Cisco's Talos Intelligence safety team, researchers said they delved into recent VPNFilter samples together with found vii novel "third-stage" modules that tin fifty-fifty exploit the networks infected routers were attached to, eventually allowing attackers to steal information together with exercise a covert network for their command together with command server for futurity attacks.
What is VPNFilter Router Malware?
Before going into the details of vii novel third-stage modules, let’s offset know the infrastructure of this multi-stage VPNFilter malware.
Unlike most other malware that targets routers, the offset phase of the VPNFilter malware was designed to persist through a reboot, gaining a persistent foothold on the infected device together with enabling the deployment of the minute phase malware.
The minute phase module of VPNFilter was non persistent, which was designed to download additional modules onto the infected routers. This module also contains a killswitch, where the malware deliberately kills itself, rendering the infected router useless.
The 3rd phase of VPNFilter is comprised of modules designed to expand the capabilities of the minute stage, similar packet sniffer, communication over Tor anonymizing network, together with exploit delivery to compromised devices via JavaScript injection.
List of Newly Discovered VPNFilter Modules
Now, here's the listing of vii novel 3rd phase modules late uncovered yesteryear Talos researchers that add together pregnant novel functionality to the VPNFilter malware:
- htpx — This module redirects together with inspects HTTP communications amongst an aim to position the presence of Windows executables inwards the network traffic. Researchers believe, amongst moderate confidence, that this module could last leveraged yesteryear attackers to inject malicious code into binary files on-the-fly equally they exceed through compromised devices.
- ndbr — This module is a multifunctional secure trounce (SSH) utility that allows a remote aggressor to plough compromised device into an SSH server, an SSH client, or an NMAP port scanner. Using SCP protocol, the ndbr utility tin also allow transfer of files.
- nm — This is a network mapping module that tin last used to perform reconnaissance from the compromised devices. Besides this, it also uses the MikroTik Network Discovery Protocol (MNDP) to locate whatsoever other MikroTik devices on the local network.
- netfilter — This module is a denial-of-service utility that allows an aggressor to laid IPtables dominion into firewall together with block sets of network addresses.
- portforwarding — This module forwards network traffic to a specified infrastructure, allowing attackers to intercept network connections.
- socks5proxy — This module sets upwards a SOCKS5 proxy on the compromised device, allowing attackers to ready a distributed network of proxies that could last leveraged inwards futurity attacks. It uses no authentication together with is hardcoded to nous on TCP port 5380.
- tcpvpn — This module sets upwards a Reverse-TCP VPN on the compromised device, allowing remote attackers to access internal networks behind infected devices.
Besides these 7 novel modules, Talos also discovered that the attackers are using MikroTik management utility called Winbox—a pocket-size native Win32 utility that allows administrators to easily laid their routers using a Web-based interface—to infect MikroTik routers.
Talos researchers released "Winbox Protocol Dissector" plugin on GitHub to allow network engineers abide by together with analyze Winbox traffic, captured using Wireshark similar tools, together with monitor utilization of the exploited Mikrotik protocol.
Since users tin teach rid of the minute phase assault yesteryear rebooting their routers, the offset phase all the same remains behind, making it possible for attackers to re-establish connections to the rebooted device together with reinstall the minute phase of VPNFilter remotely.
Thankfully, researchers believe that VPNFilter has been fully neutralized but, it's difficult to know the futurity intentions of threat actors who created this sophisticated multi-stage, all-in-one malware package.
Initially, Talos researchers had high confidence that the Russian regime was behind VPNFilter equally the malware code overlaps amongst versions of BlackEnergy—malware responsible for multiple large-scale attacks on Ukraine that the U.S., exactly the recent study does non verbalize most such claims.
