Security researchers have discovered even more dangerous capabilities in VPNFilter—the highly sophisticated multi-stage malware that infected 500,000 routers worldwide in May this year, making it much more widespread and sophisticated than earlier.

Attributed to Russia’s APT 28, also known as ‘Fancy Bear,’ VPNFilter is a malware platform designed to infect routers and network-attached storage devices from 75 brands including Linksys, MikroTik, Netgear, TP-Link, QNAP, ASUS, D-Link, Huawei, ZTE, Ubiquiti, and UPVEL.

In May, when VPNFilter infected half a million routers and NAS devices in 54 countries, the FBI seized a key command-and-control domain used by the malware and asked people to reboot their routers.

Initially, it was found that VPNFilter had been built with multiple attack modules that could be deployed to the infected routers to steal website credentials and monitor industrial controls or SCADA systems, such as those used in electric grids, other infrastructure and factories.

However, in a new report published by Cisco’s Talos Intelligence security team, researchers said they delved into recent VPNFilter samples and found seven new “third-stage” modules that can even exploit the networks infected routers were attached to, eventually allowing attackers to steal data and create a covert network for their command and control server for future attacks.

What is VPNFilter Router Malware?

Before going into the details of seven new third-stage modules, let’s first know the infrastructure of this multi-stage VPNFilter malware.

Unlike most other malware that targets routers, the first stage of the VPNFilter malware was designed to persist through a reboot, gaining a persistent foothold on the infected device and enabling the deployment of the second stage malware.

The second stage module of VPNFilter was not persistent, which was designed to download additional modules onto the infected routers. This module also contains a killswitch, where the malware deliberately kills itself, rendering the infected router useless.

The third stage of VPNFilter is comprised of modules designed to expand the capabilities of the second stage, like packet sniffer, communication over Tor anonymizing network, and exploit delivery to compromised devices via JavaScript injection.

List of Newly Discovered VPNFilter Modules

Now, here’s the list of seven new third stage modules recently uncovered by Talos researchers that add significant new functionality to the VPNFilter malware:

• htpx — This module redirects and inspects HTTP communications with an aim to identify the presence of Windows executables in the network traffic. Researchers believe, with moderate confidence, that this module could be leveraged by attackers to inject malicious code into binary files on-the-fly as they pass through compromised devices.
• ndbr — This module is a multifunctional secure shell (SSH) utility that allows a remote attacker to turn compromised device into an SSH server, an SSH client, or an NMAP port scanner. Using SCP protocol, the ndbr utility can also allow transfer of files.
• nm — This is a network mapping module that can be used to perform reconnaissance from the compromised devices. Besides this, it also uses the MikroTik Network Discovery Protocol (MNDP) to locate any other MikroTik devices on the local network.
• netfilter — This module is a denial-of-service utility that allows an attacker to set IPtables rule into firewall and block sets of network addresses.
• portforwarding — This module forwards network traffic to a specified infrastructure, allowing attackers to intercept network connections.
• socks5proxy — This module sets up a SOCKS5 proxy on the compromised device, allowing attackers to build a distributed network of proxies that could be leveraged in future attacks. It uses no authentication and is hardcoded to listen on TCP port 5380.
• tcpvpn — This module sets up a Reverse-TCP VPN on the compromised device, allowing remote attackers to access internal networks behind infected devices.

Besides these 7 new modules, Talos also discovered that the attackers are using MikroTik administration utility called Winbox—a small native Win32 utility that allows administrators to easily set up their routers using a Web-based interface—to infect MikroTik routers.

Talos researchers released “Winbox Protocol Dissector” plugin on GitHub to let network engineers detect and analyze Winbox traffic, captured using Wireshark like tools, and monitor use of the exploited Mikrotik protocol.

Since users can get rid of the second stage attack by rebooting their routers, the first stage still remains behind, making it possible for attackers to re-establish connections to the rebooted device and reinstall the second stage of VPNFilter remotely.

Thankfully, researchers believe that VPNFilter has been fully neutralized but, it’s hard to know the future intentions of threat actors who created this sophisticated multi-stage, all-in-one malware package.