Hello, welcome to the Thursday, May 24th, 2018 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Orich, and I am recording from Reston, Virginia.

The Cisco Talas research team released news regarding a pretty massive botnet. They're calling it VPN filter and say that at least 500,000 hosts are

connected to this botnet. Now, Cisco attributes this to a nation-state actor due to the sophistication

of some of the malware involved. They're also saying that infections are pretty much

worldwide, but in particular, recently, in particular the Ukraine was targeted and infected

with new systems. The botnet recruits vulnerable home routers, in particular several

lynxes system, some micro-tick routers, as well as netgear,

and some Q-Nap storage devices that are exposed to the internet. Now, one feature that sets

this particular Malver apart from many other In-N-O-T-O-T-O-T-W-T malware is that it actually survives a reboot.

Most in and of things malware goes away when you reboot the system, not this one.

It's a multi-stage malware. The first stage is designed to survive the reboot, and then it will download a second and possibly a third stage. The second

stage then provides the remote access capability for the actors and the third stage is really

more additional modules. One interesting part here, at least one of the modules can be used

to then affect industrial control networks.

Now, there are a couple of reasons why Cisco came forward and released this blog post now.

One reason is a recent sudden increase in infections, and these are these infections that in particular target the Ukraine.

The second reason is that the Malveh actually has the capability to brick the device it's installed on.

So it looks like the actor is willing to burn the botnet and destroy infected devices

to possibly keep the operation secret, which now, of course,

is no longer the case.

Now, one problem here is that it's really not easy to figure out if your device is infected.

Cisco did publish a number of indicators of compromise.

...