VPNFilter III: More Tools for the Swiss Army Knife of Malware
Summary: Cisco Talos discovered seven additional third-stage VPNFilter modules that add capabilities including exploitation of endpoint devices from compromised network devices, data filtering, and encrypted tunneling to mask command-and-control and exfiltration traffic. The research also found that MikroTik networking devices were heavily targeted by the actor, especially in Ukraine, and Talos released a decoder tool for the MikroTik Winbox protocol to help the security community hunt for malicious activity.
Key Takeaway: VPNFilter has infected hundreds of thousands of network devices worldwide, and Talos notes it can still be difficult to detect in the wild if any devices remain unpatched - so the exposure is not a fixed count but whatever is still sitting unpatched on your network.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026