A malicious code dangerous is spread to about 500 thousand router user's personal and companies, according to alert recent Cisco.
Malicious code vpnfilter attacked to router many manufacturers familiar Linksys, mikrotik, NETGEAR Dist-link and the storage devices QNAP.
According to the study from group Cisco talos of Cisco, botnet not attack on error zero-days on the device that exploit based on the vulnerabilities popular, has been published or use the information authentication default to hijack.
Malicious code vpnfilter attacked to router
Vpnfilter is malware sophisticated, there are many stage attack, can steal login information website and tracking systems industrial control SCADA, as system grid and infrastructure industry. Unlike most malware other, when was successful infection, vpnfilter will conduct restart equipment, which make be connected long-term and install malicious code for the second phase. Characteristic of botnet use malicious code vpnfilter is directory path / VAR / run / vpnfilterw was created in the installation process.. The spread of malicious code this occurs at least since 2016, so far has spread in at least 54 countries. Researchers Cisco tracked operation of malicious code this for months. Experts attt recommendations, in case of doubt equipment infected malicious this users should perform reinstalling equipment in default to delete malicious code by clicking hold back router during 5-10 seconds. Note the reset will remove all the configuration settings there, so the user will have to login again after equipment restart. Users should also change the default password of equipment and update the latest firmware for devices.