One year later: The VPNFilter catastrophe that wasn't
Summary: Cisco Talos disclosed VPNFilter on May 23, 2018, a nation-state malware infecting half a million devices that was neutralized when the FBI seized its command-and-control infrastructure before orders could be broadcast. Code reuse tied the malware to APT28 (Sofacy), the group behind the BlackEnergy attacks on Ukraine's power grid in December 2015, and the malware could brick devices, downgrade HTTPS to HTTP, harvest credentials, and monitor Modbus traffic in industrial control systems.
What you should know: Half a million compromised routers sat in networks as a standing capability to brick devices, reroute traffic, and watch Modbus links into industrial systems - and it was stopped by taking down command infrastructure, not by cleaning the devices, which means the same exposure remains wherever perimeter gear goes unpatched.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026