{"id":2518,"date":"2018-05-25T18:22:04","date_gmt":"2018-05-25T11:22:04","guid":{"rendered":"https:\/\/humanit.asia\/?p=2518"},"modified":"2019-07-22T15:00:13","modified_gmt":"2019-07-22T08:00:13","slug":"ta18-145a","status":"publish","type":"post","link":"https:\/\/old.humanit.asia\/th\/ta18-145a\/","title":{"rendered":"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide"},"content":{"rendered":"<div>\n<p>Original release date: May 25, 2018<\/p>\n<h3>Systems Affected<\/h3>\n<ul>\n<li>Small office\/home office (SOHO) routers<\/li>\n<li>Networked devices<\/li>\n<li>Network-attached storage (NAS) devices<\/li>\n<\/ul>\n<h3>Overview<\/h3>\n<p>Cybersecurity researchers have identified that foreign cyber actors have compromised hundreds of thousands of home and office routers and other networked devices worldwide <a href=\"https:\/\/blog.talosintelligence.com\/2018\/05\/VPNFilter.html\">[1]<\/a>\u00a0<a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected\">[2]<\/a>. The actors used VPNFilter malware to target small office\/home office (SOHO) routers. VPNFilter malware uses modular functionality to collect intelligence, exploit local area network (LAN) devices, and block actor-configurable network traffic. Specific characteristics of VPNFilter have only been observed in the BlackEnergy malware, specifically BlackEnergy versions 2 and 3.<\/p>\n<p>The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) recommend that owners of SOHO routers power cycle (reboot) SOHO routers and networked devices to temporarily disrupt the malware.<\/p>\n<p>DHS and FBI\u00a0encourage\u00a0SOHO router owners\u00a0to report information concerning suspicious or criminal activity to their local FBI field office or the FBI\u2019s 24\/7 Cyber Watch (CyWatch). Field office contacts can be identified at <a href=\"http:\/\/www.fbi.gov\/contact-us\/field\">www.fbi.gov\/contact-us\/field<\/a>. CyWatch can be contacted by phone at 855-292-3937 or by email at CyWatch@fbi.gov. Each submitted report should include as much informaiton as possible, specifically\u00a0the date, time, location, type of activity, number of people, the type of equipment used for the activity, the name of the submitting company or organization, and a designated point of contact.<\/p>\n<h3>Description<\/h3>\n<p>The size and scope of this infrastructure impacted by VPNFilter malware is significant. The persistent VPNFilter malware linked to this infrastructure targets a variety of SOHO routers and network-attached storage devices. The initial exploit vector for this malware is currently unknown.<\/p>\n<p>The malware uses a modular functionality on SOHO routers to collect intelligence, exploit LAN devices, and block actor-configurable network traffic. The malware can render a device inoperable, and has destructive functionality across routers, network-attached storage devices, and central processing unit (CPU) architectures running embedded Linux. The command and control mechanism implemented by the malware uses a combination of secure sockets layer (SSL) with client-side certificates for authentication and TOR protocols, complicating network traffic detection and analysis.<\/p>\n<h3>Impact<\/h3>\n<p>Negative consequences of VPNFilter malware infection include:<\/p>\n<ul>\n<li>temporary or permanent loss of sensitive or proprietary information,<\/li>\n<li>disruption to regular operations,<\/li>\n<li>financial losses incurred to restore systems and files, and<\/li>\n<li>potential harm to an organization\u2019s reputation.<\/li>\n<\/ul>\n<h3>Solution<\/h3>\n<p>DHS and FBI recommend\u00a0that all SOHO router owners power cycle (reboot) their devices to temporarily disrupt the malware.<\/p>\n<p>Network device management interfaces\u2014such as Telnet, SSH, Winbox, and HTTP\u2014should be turned off for wide-area network (WAN) interfaces, and, when enabled, secured with strong passwords and encryption. Network devices should be upgraded to the latest available versions of firmware, which often contain patches for vulnerabilities.<\/p>\n<p>Rebooting affected devices will cause non-persistent portions of the malware to be removed from the system. Network defenders should ensure that first-stage malware is removed from the devices, and appropriate network-level blocking is in place prior to rebooting affected devices. This will ensure that second stage malware is not downloaded again after reboot.<\/p>\n<p>While the paths at each stage of the malware can vary across device platforms, processes running with the name &#8220;vpnfilter&#8221; are almost certainly instances of the second stage malware. Terminating these processes and removing associated processes and persistent files that execute the second stage malware would likely remove this malware from targeted devices.<\/p>\n<h3>References<\/h3>\n<ul>\n<li><a href=\"https:\/\/blog.talosintelligence.com\/2018\/05\/VPNFilter.html\">[1] New VPNFilter malware targets at least 500K networking devices worldwide <\/a><\/li>\n<li><a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected\">[2] Justice Department Announces Actions to Disrupt Advanced Persistent Threat 28 Botnet of Infected Routers and Network Storage<\/a><\/li>\n<\/ul>\n<h3>Revision History<\/h3>\n<ul>\n<li>May 25, 2018: Initial Version<\/li>\n<\/ul>\n<hr \/>\n<p>This product is provided subject to this <a href=\"http:\/\/www.us-cert.gov\/privacy\/notification\">Notification<\/a> and this <a href=\"http:\/\/www.us-cert.gov\/privacy\/\">Privacy &amp; Use<\/a> policy.<\/p>\n<\/div>\n<p class=\"wpematico_credit\"><small>Powered by <a href=\"http:\/\/www.wpematico.com\" target=\"_blank\" rel=\"noopener noreferrer\">WPeMatico<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Original release date: May 25, 2018 Systems Affected Sm [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[106],"tags":[],"class_list":["post-2518","post","type-post","status-publish","format-standard","hentry","category-alerts-th"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide - humanit managed services<\/title>\n<meta name=\"description\" content=\"Cybersecurity researchers have identified that foreign cyber actors have compromised hundreds of thousands of home and office routers\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/old.humanit.asia\/ta18-145a\/\" \/>\n<meta property=\"og:locale\" content=\"th_TH\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide - humanit managed services\" \/>\n<meta property=\"og:description\" content=\"Cybersecurity researchers have identified that foreign cyber actors have compromised hundreds of thousands of home and office routers\" \/>\n<meta property=\"og:url\" content=\"https:\/\/old.humanit.asia\/ta18-145a\/\" \/>\n<meta property=\"og:site_name\" content=\"humanit managed services\" \/>\n<meta property=\"article:published_time\" content=\"2018-05-25T11:22:04+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-07-22T08:00:13+00:00\" \/>\n<meta name=\"author\" content=\"Admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u0e19\u0e32\u0e17\u0e35\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/ta18-145a\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/ta18-145a\\\/\"},\"author\":{\"name\":\"Admin\",\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#\\\/schema\\\/person\\\/e7a3d665ee9cc6526fb6fdc92f4eb09c\"},\"headline\":\"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide\",\"datePublished\":\"2018-05-25T11:22:04+00:00\",\"dateModified\":\"2019-07-22T08:00:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/ta18-145a\\\/\"},\"wordCount\":612,\"articleSection\":[\"Alerts\"],\"inLanguage\":\"th\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/ta18-145a\\\/\",\"url\":\"https:\\\/\\\/old.humanit.asia\\\/ta18-145a\\\/\",\"name\":\"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide - humanit managed services\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#website\"},\"datePublished\":\"2018-05-25T11:22:04+00:00\",\"dateModified\":\"2019-07-22T08:00:13+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#\\\/schema\\\/person\\\/e7a3d665ee9cc6526fb6fdc92f4eb09c\"},\"description\":\"Cybersecurity researchers have identified that foreign cyber actors have compromised hundreds of thousands of home and office routers\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/ta18-145a\\\/#breadcrumb\"},\"inLanguage\":\"th\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/old.humanit.asia\\\/ta18-145a\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/ta18-145a\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/old.humanit.asia\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#website\",\"url\":\"https:\\\/\\\/old.old.humanit.asia\\\/\",\"name\":\"humanit managed services\",\"description\":\"making technology easy\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/old.old.humanit.asia\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"th\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#\\\/schema\\\/person\\\/e7a3d665ee9cc6526fb6fdc92f4eb09c\",\"name\":\"Admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"th\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g\",\"caption\":\"Admin\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide - humanit managed services","description":"Cybersecurity researchers have identified that foreign cyber actors have compromised hundreds of thousands of home and office routers","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/old.humanit.asia\/ta18-145a\/","og_locale":"th_TH","og_type":"article","og_title":"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide - humanit managed services","og_description":"Cybersecurity researchers have identified that foreign cyber actors have compromised hundreds of thousands of home and office routers","og_url":"https:\/\/old.humanit.asia\/ta18-145a\/","og_site_name":"humanit managed services","article_published_time":"2018-05-25T11:22:04+00:00","article_modified_time":"2019-07-22T08:00:13+00:00","author":"Admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Admin","Est. reading time":"3 \u0e19\u0e32\u0e17\u0e35"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/old.humanit.asia\/ta18-145a\/#article","isPartOf":{"@id":"https:\/\/old.humanit.asia\/ta18-145a\/"},"author":{"name":"Admin","@id":"https:\/\/old.old.humanit.asia\/#\/schema\/person\/e7a3d665ee9cc6526fb6fdc92f4eb09c"},"headline":"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide","datePublished":"2018-05-25T11:22:04+00:00","dateModified":"2019-07-22T08:00:13+00:00","mainEntityOfPage":{"@id":"https:\/\/old.humanit.asia\/ta18-145a\/"},"wordCount":612,"articleSection":["Alerts"],"inLanguage":"th"},{"@type":"WebPage","@id":"https:\/\/old.humanit.asia\/ta18-145a\/","url":"https:\/\/old.humanit.asia\/ta18-145a\/","name":"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide - humanit managed services","isPartOf":{"@id":"https:\/\/old.old.humanit.asia\/#website"},"datePublished":"2018-05-25T11:22:04+00:00","dateModified":"2019-07-22T08:00:13+00:00","author":{"@id":"https:\/\/old.old.humanit.asia\/#\/schema\/person\/e7a3d665ee9cc6526fb6fdc92f4eb09c"},"description":"Cybersecurity researchers have identified that foreign cyber actors have compromised hundreds of thousands of home and office routers","breadcrumb":{"@id":"https:\/\/old.humanit.asia\/ta18-145a\/#breadcrumb"},"inLanguage":"th","potentialAction":[{"@type":"ReadAction","target":["https:\/\/old.humanit.asia\/ta18-145a\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/old.humanit.asia\/ta18-145a\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/old.humanit.asia\/"},{"@type":"ListItem","position":2,"name":"TA18-145A: Cyber Actors Target Home and Office Routers and Networked Devices Worldwide"}]},{"@type":"WebSite","@id":"https:\/\/old.old.humanit.asia\/#website","url":"https:\/\/old.old.humanit.asia\/","name":"humanit managed services","description":"making technology easy","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/old.old.humanit.asia\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"th"},{"@type":"Person","@id":"https:\/\/old.old.humanit.asia\/#\/schema\/person\/e7a3d665ee9cc6526fb6fdc92f4eb09c","name":"Admin","image":{"@type":"ImageObject","inLanguage":"th","@id":"https:\/\/secure.gravatar.com\/avatar\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g","caption":"Admin"}}]}},"_links":{"self":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts\/2518","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/comments?post=2518"}],"version-history":[{"count":2,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts\/2518\/revisions"}],"predecessor-version":[{"id":2867,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts\/2518\/revisions\/2867"}],"wp:attachment":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/media?parent=2518"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/categories?post=2518"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/tags?post=2518"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}