NCCIC is aware of a sophisticated modular malware system known as VPNFilter. Devices known to be affected by VPNFilter include Linksys, MikroTik, NETGEAR, and TP-Link networking equipment, as well as QNAP network-attached storage (NAS) devices. Devices compromised by VPNFilter may be vulnerable to the collection of network traffic (including website credentials), as well as the monitoring of Modbus supervisory control and data acquisition (SCADA) protocols.
VPNFilter has a destructive capability that can make the affected device unusable. Because the malware can be triggered to affect devices individually or multiple devices at once, VPNFilter has the potential to cut off internet access for hundreds of thousands of users.
NCCIC encourages users and administrators to review the Cisco blog post on VPNFilter and NCCIC’s Tip on Home Network Security for recommendations and to ensure that their devices are updated with the latest patches. NCCIC will provide updated information as it becomes available.
This product is provided subject to this Notification and this Privacy & Use policy.