VPNFilter - YetAnotherBotNet Or Maybe Not...
summary
A multi-stage router malware chain uses a Stage‑1 photo hosting JPEG fetch (embedded IP) with fallbacks, infects ~500,000 devices across 54 countries and 11 vendors, then pulls Stage‑2 plugins over Tor/SSL. Stage‑2 includes a lightweight packet sniffer targeting Modbus and credential grabs, an SSL hijack module that injects JavaScript and steals session cookies, and a reverse‑VPN/proxy pivot into LANs. A Stage‑3 destroyer fills flash with 0xFF after stopping processes to prevent forensics. US DOJ links the infrastructure to Russian APT activity.
AI-written summary · about
chapters (14)
- 0:00Introduction to VPNFilter
- 1:31Discovery and scope of malware
- 3:15Why we published findings
- 4:18Infection process and stage one
- 7:27C2 infrastructure and listener mechanism
- 11:42Stage two capabilities
- 12:49Stage three advanced features
- 14:16Packet sniffer module
- 16:25SSLare exploit module
- 19:59Destroyer module analysis
- 23:09Attribution to Russian actors
- 27:05Timeline and related malware
- 31:18Defense challenges and conclusions
- 34:09Q&A and contact information
related talks
23mThe Rise of the Eternal Botnet
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
37mMoustachedBouncer: AitM-Powered Surveillance via Belarus ISPs
46mAttacks, Lies and the Underground World
59mCatching Malware En Masse: DNS and IP Style
47mDetecting and analyzing files-less malware
43mSecure, Free VPN — Are You Sure?
47mDNS On Fire