Hackers infect more than 500,000 devices as malicious attack looms

Tech giant has high confidence that Russian government is behind the campaign

Cisco has warned that hackers have infected at least 500,000 routers and storage devices in dozens of countries with sophisticated malicious software - activity Ukraine said was preparation for a future Russian cyber attack.

Cisco's Talos cyber intelligence unit has high confidence that the Russian government is behind the campaign, according to Cisco researcher Craig Williams, because the hacking software shares code with malware used in previous cyber attacks that the US Government has attributed to Moscow.

Talos said in a blog post that it estimated the number of infected devices to be at least 500,000 in at least 54 countries. 

"The known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices," it said. "No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues."

Ukraine's SBU state security service said the activity showed Russia was readying a large-scale cyber attack against Ukraine ahead of the Champions League soccer final, due to be held in Kiev on Saturday.

"Security Service experts believe the infection of hardware on the territory of Ukraine is preparation for another act of cyber aggression by the Russian Federation aimed at destabilising the situation during the Champions League final," it said in a statement after Cisco's findings were released.

Russia has previously denied assertions by Ukraine, the United States, other nations and Western cyber security firms that it is behind a massive global hacking program, which has included attempts to harm Ukraine's economy and interfering in the 2016 U.S. presidential election.

The Kremlin did not immediately respond to a request for comment on Wednesday.

Cisco said the new malware, dubbed VPNFilter, could be used for espionage, to interfere with internet communications or launch destructive attacks on Ukraine, which has previously blamed Russia for massive hacks that took out parts of its energy grid and shuttered factories.

"With a network like this you could do anything," Williams said.

Constitution day attack

The warning about the malware - which includes a module that targets industrial networks like ones that operate the electric grid - will be amplified by alerts from members of the Cyber Threat Alliance (CTA), a nonprofit group that promotes the fast exchange of data on new threats between rivals in the cyber security industry.

Members include Cisco; Check Point Software Technologies; Fortinet; Palo Alto Networks; Sophos and Symantec.

“We should be taking this pretty seriously," CTA CEO Michael Daniel said in an interview.

The devices infected with VPNFilter are scattered across at least 54 countries, but Cisco determined the hackers are targeting Ukraine following a surge in infections in that country on 6 May, Williams said.

Researchers decided to go public with what they know about the campaign because they feared the surge in Ukraine, which has the largest number of infections, meant Moscow is poised to launch an attack there next month, possibly around the time the country celebrates Constitution Day on 28 June, Williams said.

Some of the biggest cyber attacks on Ukraine have been launched on holidays or the days leading up to them.

They include the June 2017 "NotPetya" attack that disabled computer systems in Ukraine before spreading around the globe, as well as hacks on the nation's power grid in 2015 and 2016 that hit shortly before Christmas.

VPNFilter gives hackers remote access to infected machines, which they can use for spying, launching attacks on other computers or downloading additional types of malware, Williams said.

The researchers discovered one malware module that targets industrial computers, such as ones used in electric grids, other infrastructure and in factories. It infects and monitors network traffic, looking for login credentials that a hacker can use to seize control of industrial processes, Williams said.

The malware also includes an auto-destruct feature that hackers can use to delete the malware and other software on infected devices, making them inoperable, he said.

(Writing by Jim Finkle and Jack Stubbs; Editing by Mark Heinrich)

Article updated to clarify that Cisco devices have not been targeted.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags cisco

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Reuters

Reuters

Channel Asia
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Cate Bacon

Aruba Instant On AP11D

The strength of the Aruba Instant On AP11D is that the design and feature set support the modern, flexible, and mobile way of working.

Dr Prabigya Shiwakoti

Aruba Instant On AP11D

Aruba backs the AP11D up with a two-year warranty and 24/7 phone support.

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?