VPNFilter

MITRE ATT&CK: S1010 View on attack.mitre.org

Aliases: VPNFilter

First seen
2018-05-23 00:00:00
Malware type
botnet, credential-stealer, wiper
Family
Malware family
Operating systems
network-devices, linux
Last IoC activity
2026-07-11 12:45:10
Profile updated
2026-07-07 12:43:22

Targeted industries: government-and-public-sector energy-and-utilities technology-and-telecommunications

Targeted regions: country_code:ua country_code:us

Context

VPNFilter is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. VPNFilter modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. VPNFilter was assessed to be replaced by Sandworm Team with Cyclops Blink starting in 2019.

Detection coverage

  • 1 Sigma rules

Malware & tools used

  • Disk Content Wipe (attack-pattern)
  • Adversary-in-the-Middle (attack-pattern)
  • Network Sniffing (attack-pattern)

Used by threat actors

Reports & references

  • justice.gov — Justice Department Announces Actions Disrupt Advanced Persistent Threat 28 Botnet Infected (report)
  • services.google.com — Apt44 Unearthing Sandworm (report)
  • CISA — Aa22 110A (report)
  • gov.uk — Uk Exposes Series Of Russian Cyber Attacks Against Olympic And Paralympic Games (report)
  • Microsoft — Corporate Iot A Path To Intrusion (report)
  • ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
  • sentinelone.com — Acidrain A Modem Wiper Rains Down On Europe (report)
  • CISA — Aa22 054A (report)
  • lacework.com — Mirai Goes Stealth Tls Iot Malware (report)
  • tesorion.nl — Report Osint Russia Ukraine Conflict Cyberaspect (report)
  • malpedia.caad.fkie.fraunhofer.de — Elf.Vpnfilter (report)
  • Trend Micro — Vpnfilter Affected Devices Still Riddled With 19 Vulnerabilities (report)
  • Cisco Talos — Vpnfilter (report)
  • CISA — Aa22 054A%20New%20Sandworm%20Malware%20Cyclops%20Blink%20Replaces%20Vpn%20Filter (report)
  • i.blackhat.com — Us 19 Doerr The Enemy Within Modern Supply Chain Attacks (report)
  • Cisco Talos — Threat Advisory Cyclops Blink (report)
  • Cisco Talos — One Year Later Vpnfilter Catastrophe (report)
  • ncsc.gov.uk — Joint Advisory Shows New Sandworm Malware Cyclops Blink Replaces Vpnfilter (report)
  • Broadcom/Symantec — Vpnfilter Iot Malware (report)
  • sophos.com — Sophos Vpn Filter Analysis V2 (report)
  • Trend Micro — Vpnfilter Two Years Later Routers Still Compromised (report)
  • Cisco Talos — Vpnfilter Update (report)
  • Cisco Talos — Current Executive Guidance For Ongoing (report)
  • Cisco Talos — Vpnfilter Part 3 (report)
  • Kaspersky — 85721 (report)

External references