On May 23, 2018, Talos Group released its analysis of an ongoing malware attack it named “VPNFilter.” The Talos analysis indicates that this attack was first identified in 2016 and, as of June 2018, has compromised more than 500,000 endpoints. The compromised endpoints themselves are predominantly small office or home office (SOHO) routers; however, network attached storage (NAS) offerings like QNAP, a common SOHO NAS appliance, have also been targeted.
Furthermore, VPNFilter shows similarities in code and functionality to BlackEnergy malware. BlackEnergy effectively targeted industrial enterprise networks and was responsible for the December 2015 Ukraine power grid cyberattack that left 80,000 people without power for more than six hours. Like BlackEnergy, VPNFilter maintains a Supervisory Control and Data Acquisition (SCADA) monitoring plug-in that operators can configured.
The severity of VPNFilter’s malicious potential is further exacerbated as attackers appear to be spreading the malware manually, and no complex automated targeting features have yet been detected. (Symantec’s analysis has more on this.) The malware also maintains a robust toolset capable of performing several remote actions indicative of heavily controlled malware including:
- DDoS attacks
- Command execution
- SCADA monitoring
- Network sniffing
- Credential stealing
- Tor proxy connections
- Data erasure
- Device destruction
Suspected Origins
VPNFilter, much like BlackEnergy, has targeted Ukrainian organizations. Evidence reveals that the malware’s supporting infrastructure maintains a single command and control (C2) server through which a majority of identified compromised Ukrainian organizations communicate. VPNFilter’s scope appears to expand beyond Ukraine, however, as there are known compromised network devices across 54 unique countries. Security Week released an article on May 28, 2018 drawing connections between the BlackEnergy code sharing and Ukrainian targeting as common Russian activity.
The Current State of VPNFilter Malware
VPNFilter is difficult to detect because it predominantly targets embedded network appliances that traditionally sit at the edge of a network outside of the majority of network monitoring appliances. Most devices compromised by VPNFilter are generic devices made from the following companies: Linksys, MikroTik, NETGEAR, and TP-Link. A complete listing of the known SOHO device models vulnerable to VPNFilter is available at the end of this blog post.
SOHO environments are not usually monitored or managed on an ongoing basis, and the inherently poor security hygiene typical of these devices certainly doesn’t help. To make matters worse, VPNFilter targets devices are built on BusyBox or Linux firmware, opening the door for additional IoT-style devices to fall into the scope of VPNFilter’s reach.
VPNFilter Malware Analysis
VPNFilter malware comprises of a three-staged execution with each stage performing a specific functionality:
Stage 1
In stage 1, the malware gains control of the device and establishes persistence. It is important to note that stage 1 is the only stage that establishes persistence on an infected device. Persistence is achieved by modifying the NVRAM memory and the creating a cronjob. The ability for VPNFilter to create persistence differentiates itself from other IoT-style malware as it remains on the device after a reboot.
Stage 1 exists purely to install stage 2. To achieve installation, the malware establishes an encrypted connection through SSL to the legitimate website: photobucket.com. (A complete list of compromised Photobucket accounts is available below.) Should a compromised device successfully connect to one of the Photobucket images, stage 1 will scrape the image’s EXIF metadata for its latitude and longitude coordinates. These coordinate values are binary value representations of a VPNFilter’s C2 system. Stage 1 will then use the C2 IP address to download stage 2. (To learn how the stage 1 malware decodes the IP addresses from the GPS coordinates, Kaspersky SecureList Blog wrote a detailed description of this process.)
If stage 1 is unable to acquire a working C2 address from the Photobucket addresses, the malware will attempt to follow the same process via a backup domain, toknowall[.]com. If this attempt is also unsuccessful, the stage 1 malware will enter a listen-only mode in which it will listen to all inbound packets with the device’s destination IP address that have the SYN flag set. If a packet matches, stage 1 scans for the byte value \x0C\x15\x22\x2B. If this is a successful match, stage 1 will extract the next four bytes, each of which represents an IPv4 octet represented in a one-byte integer. By combining these bytes, the address for a C2 system containing the stage 2 malware for download can be recovered. Stage 1 initiates a final action of performing a size-check to ensure that the stage 2 file has at least 1,001 bytes of data to perform its function.
Stage 2
Stage 2 contains the bulk of functionality for the VPNFilter malware. It is important to note that this stage does not maintain persistence on the device in and of itself. If the device were to reboot, the malware would no longer be present on the device and stage 1, which is persistent, would have to download stage 2 again. Coincidently, the malware also relies on this non-persistence to function as a failsafe measure. The functions stage 2 can perform are pulled from the malware’s switch options, which include:
- Kill: Rewrites the first 5000 bytes of the /dev/mtdblock0 with binary zeros — bricking the device
- Exec: Provides shell capabilities
- Tor: Establishes Tor functionality
- Copy: Copies data from the device to the C2 server
- Seturl: Alters the configured URL
- Proxy: Sets current proxy URL
- Port: Sets the current proxy port
- Delay: Sets time delay between executions
- Reboot: Reboots the device
- Download: Downloads a given URL to a file
Given the above commands, the attacker can download additional tools, exfiltrate data from the device, alter the communication paths (including URLs and ports), and break the device by rewriting the boot records of the device followed by a restart.
Perhaps the most interesting aspect of this particular stage is the attacker’s ability to direct traffic through a Tor infrastructure. This capability allows the device to communicate over an encrypted and anonymized proxy network, masking attribution and preventing network sniffing of device communications. It appears the attacker can turn this functionality on and off at will. The ability to enable Tor communications also leads to stage 3 of the malware.
Stage 3
Stage 3 is considered the plug-in stage, providing the stage 2 malware with additional capabilities tailored for specific uses. As of the time the Talos post published, there were only two known plug-in modules: the Tor plug-in just discussed, and a packet sniffer plug-in.
The stage 3 sniffer plug-in can perform basic network packet monitoring centered around HTTP authentication and on the Modbus SCADA protocol. The HTTP request sniffing is known to collect website credentials, which it stores on the compromised device. The collected credentials can be used to enable future network compromise. Additionally, the sniffing plug-in can monitor the ModBus protocol used to display system statistics and data in a human-readable manner from SCADA systems. The plug-in monitors SCADA system data and saves this data to the compromised device, storing the data within the VPNFilter working directory.
This SCADA-monitoring plug-in highlights the close ties with the BlackEnergy trojan previously mentioned.
How to Mitigate VPNFilter Malware
Talos provides two steps to mitigate a VPNFilter compromise:
- Reset devices to factory settings and reboot.
- Patch and update routers with the latest firmware.
Rebooting network devices alone will not remove the infection completely. Rebooting the device will only remove stage 2 and stage 3 infections; it will not address stage 1 infections, (because this stage maintains persistence). An additional mitigation step that could be included would be to monitor traffic leaving your network perimeter.
Detect VPNFilter with LogRhythm’s AI Engine Rules
To help you detect VPNFilter, LogRhythm Labs has implemented VPNFilter malware alarms within the Current Active Threat (CAT) Module. LogRhythm Labs has also supplied customers with AI Engine rules designed to identify network communications between network devices, any of the known VPNFilter C2 infrastructure, and all of the identified URL addresses used to propagate malware across a victim network.
If you are a LogRhythm client and have enabled the CAT module, the AI Engine rules are already uploaded to your environment. Should an event regarding either C2 or URL connections occur within your environment and log sources are properly configured to collect and transmit this data to LogRhythm, the CAT : VPNFilter alarms will fire. For customers who have not upgraded to at least LogRhythm 7.3.1, or for customers who simply wish to manually import the CAT : VPNFilter rules, please click here to download the content.
Indicators of Compromise (IOCs)
The following lists delineate all of the known indicators for the VPNFilter malware:
Vulnerable Devices:
- Linksys Devices
- E2500
- WRVS4400N
- MikroTik
- 1016
- 1036
- 1072
- NetGear
- DGN2200
- R6400
- R7000
- R8000
- WNR1000
- WNR2000
- QNAP
- TS251
- TS439 Pro
- TP-Link
- R600VPN
URLs
- photobucket[.]com/user/nikkireed11/library
- photobucket[.]com/user/kmila302/library
- photobucket[.]com/user/lisabraun87/library
- photobucket[.]com/user/eva_green1/library
- photobucket[.]com/user/monicabelci4/library
- photobucket[.]com/user/katyperry45/library
- photobucket[.]com/user/saragray1/library
- photobucket[.]com/user/millerfred/library
- photobucket[.]com/user/jeniferaniston1/library
- photobucket[.]com/user/amandaseyfried1/library
- photobucket[.]com/user/suwe8/library
- photobucket[.]com/user/bob7301/library
- toknowall[.]com
Tor Address
- zuh3vcyskd4gipkm[.]onion/bin32/update.php
Command and Control
- 5.149.250[.]54
- 62.210.180[.]229
- 82.118.242[.]124
- 91.121.109[.]209
- 91.200.13[.]76
- 91.214.203[.]144
- 94.185.80[.]82
- 94.242.222[.]68
- 95.211.198[.]231
- 46.151.209[.]33
- 195.154.180[.]60
- 217.12.202[.]40
- 217.12.202[.]40
- 217.79.179[.]14
Malware Hashes
Stage 1
- 50ac4fcd3fbc8abcaa766449841b3a0a684b3e217fc40935f1ac22c34c58a9ec
- 45871bad3a9b4594fc3de39e4b5930ad
- cbf45c52046564af6fa40b65bc41725e23935cd7
- 0e0094d9bd396a6594da8e21911a3982cd737b445f591581560d766755097d92
- 5f358afee76f2a74b1a3443c6012b27b
- 4ac8d962c6072b77f157c5d6459b887a658d66d5
Stage 2
- 9683b04123d7e9fe4c8c26c69b09c2233f7e1440f828837422ce330040782d17
- 4912aad5e79c78bc143e71633df9c17b
- 4abb20f92c04e1118e356936f36359620e998de7
- d6097e942dd0fdc1fb28ec1814780e6ecc169ec6d24f9954e71954eedbc4c70e
- 87049e223dd922dc1d8180c83e2fde77
- 8a189f0c6a69efeaed1916860a0ff74e424563f6
- 4b03288e9e44d214426a02327223b5e516b1ea29ce72fa25a2fcef9aa65c4b0b
- 17e5e5c25eef807a08f02b8e435dda30
- 8c29ad07039b6d5b672743efc007fc07f4197b68
- 9eb6c779dbad1b717caa462d8e040852759436ed79cc2172692339bc62432387
- 42d891bcdee9588f8ed5d27456896a5e
- b0e0853d1aa3c318627f92bec64fe7d42490cb3a
- 37e29b0ea7a9b97597385a12f525e13c3a7d02ba4161a6946f2a7d978cc045b4
- 19dd8b95fcca498582642f5a0b2fc58b
- 0752c7e01025cf3689ce283e0389d388f7268048
- 776cb9a7a9f5afbaffdd4dbd052c6420030b2c7c3058c1455e0a79df0e6f7a1d
- 8e74e36ba104389aa6dc4d4429bcf0cf
- f16c48ead435d2574abd2e18836681ba2ce788e7
- 8a20dc9538d639623878a3d3d18d88da8b635ea52e5e2d0c2cce4a8c5a703db1
- 92d47495c92d8c5dba107163df2bb212
- 60a5b825c197a8788b8934c31e7453bd9a87e452
- 0649fda8888d701eb2f91e6e0a05a2e2be714f564497c44a3813082ef8ff250b
- 93ff367439becebd9d71c3e12041c95e
- a0d9f148e319fb604d7a70f4b482a2d9d06232fb
Stage 3
- f8286e29faa67ec765ae0244862f6b7914fcdde10423f96595cb84ad5cc6b344
- 97444b5209278ed611e6a94076e814c8
- a5e0d0ebe41683619d1b9802149f0403b1a7d8be
- afd281639e26a717aead65b1886f98d6d6c258736016023b4e59de30b7348719
- b5dc976043db9b42c9f6fa889205c68a
- 4fcb3f9cdf5a6150cc111ac8f6ae0b273c0f740e