VPNFilter Update - VPNFilter exploits endpoints, targets new devices
Summary: Cisco Talos reported that VPNFilter is targeting more device makes and models than first thought, adding ASUS, D-Link, Huawei, Ubiquiti, UPVEL and ZTE to the list alongside new devices from Linksys, MikroTik, Netgear and TP-Link. Talos also found a new stage 3 module called "ssler" that intercepts port 80 traffic, injects JavaScript and delivers exploits to endpoints via man-in-the-middle, plus a "dstr" module that wipes a device's files and reboots it so it fails to boot.
Key Takeaway: The malware now reaches past the infected router into the networks it supports, letting the actor deploy rootkits, exfiltration tools or destructive malware onto endpoints - and the dstr module can render a device unbootable after erasing its own traces.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026