Malware Spreading Through Linksys, Netgear, TP-Link routers and QNAP NAS

There is a report going viral at the moment, a new aggressive malware dubbed VPNFilter is spreading rapidly. Cisco is spreading the news that already over half a million devices in at least 54 countries already have been infected. 

While the list may not be complete, the known devices affected by the malware called VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices.  While we're always a bit careful pointing fingers, I'll just quote Cisco; "Cisco’s Talos cyber intelligence unit has high confidence that the Russian government is behind the campaign, according to Cisco researcher Craig Williams, because the hacking software shares code with malware used in previous cyber attacks that the U.S. government has attributed to Moscow". 

VPNFilter allows hackers to access infected computers and devices. Then, according to Cisco, they can be used for espionage or the execution of attacks (DDoS) on other computers and networks. It is not yet clear how the devices precisely become infected however most routers and NAS servers targeted, particularly run older versions of OS software and/or have known public exploits or default credentials that make compromise relatively straightforward. 

Routers from Linksys, Mikrotik, Netgear and TP-link and NAS systems from Qnap are most susceptible, Cisco recommends that users restore the devices to the factory settings to remove the malware. We obviously recommend you to install the latest firmware on your Router and internet connected NAS units.

Source: Cisco's Talos and Reuters.