Name of Malware: VPNfilter

Type of Malware: Iot worm, info stealer

Affected Operating Systems: Linux

Affected Device Types: Home routers, NAS devices

Impact: medium

What is VPNfilter?

VPNfilter is a multi-level IoT worm used to capture and steal data. It can take control of the affected device or cause physical damage that renders the device unusable.

How did I get infected with VPNfilter?

VPNfilter spreads by searching for vulnerable devices with weak passwords and/or old firmware versions. The susceptible devices are primarily routers and network-attached storage devices from the manufacturers ASUS, D-Link, Linksys, MikroTik, Netgear, Qnap, TP-Link, Huawei, Ubiquiti, UPVEL and ZTE.

What do I have to do now?

Reset affected devices to the factory settings, restart them and install the latest firmware/software versions before reconnecting the device to the network.

Technical specifications

Further information on this malware can be found on the website of our project partner Fraunhofer FKIE.