Description
VPNFilter is a multi-stage, modular platform for network devices with capabilities supporting both intelligence collection and destructive attack operations. Its modules can collect traffic passing through an infected device, stealing website credentials and monitoring industrial protocols, and authorities assessed that the Sandworm team replaced it with Cyclops Blink from 2019.
Stats
- First seen
- March 2022
- Last seen
- October 2026
MITRE ATT&CK techniques
1 techniques across 1 tactics.
Associated groups
Alert name variants
| Alert Name |
|---|
| Linux.Trojan.VPNFilter |
| Trojan.Linux.VPNFilter.A |
| Trojan.Linux.VPNFilter.B |
| Trojan.Linux.VPNFilter.C |
| Trojan.Linux.VPNFilter.D |