ctrlINT What the industry said about every indicator, with the quote

VPNFilterMalware

VPNFilter is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. VPNFilter modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols.From MITRE ATT&CK

Last reported 1 month ago, by Cisco Talos3 reports

ATT&CK techniques

1 technique · each with the sentence it comes from
  1. T1219Remote Access Tools

    “The inclusion of a vulnerable driver to terminate EDR software and the deployment of unauthorized remote access tools give attackers deep, persistent control over infected systems.”

    Cisco TalosVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

3 reports, newest first · the exact sentence from each

  1. “Last year I gave an interview with the amazing Hazel Burton about VPNFilter, and my run-in with burnout.”

    Cisco TalosVendor
    We've got one word for it, and it's usually the wrong one

  2. “Examples range from criminal botnet activity such as the many variants of Mirai, to more concerning state-sponsored campaigns such as VPNFilter and CyclopsBlink.”

    HuntressVendor
    Calm In The Storm: Reviewing Volt Typhoon

  3. “Case Study: VPNFilter malware”

    NCSC UKGovernment
    Organisational use of Enterprise Connected Devices

Indicators in its reports

named in the reports above
Copy these 12 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with VPNFilter here?
No account needed. We do not store your IP address.