If you suspect that your router might be affected by VPNFilter Malware, it's crucial to take immediate action to protect your network. This guide will help you understand what to do if your router is compromised, how to identify if your router is affected and provide an overview of VPNFilter Malware.
🚨 Reboot immediately by performing a hard reset on the device!
Reset to Factory Default: Hold the Reset button on the rear of the device for at least five seconds until the power LED starts blinking.
Update Firmware: Ensure all devices are updated to the latest firmware.
Change Admin Password: Make sure the default admin password has been changed to a more secure one.
Disable Remote Management: This is disabled by default and can only be enabled via Advanced Settings.
Enable URL Filter:
Go to Advanced Settings -> Firewall.
Set the Filter table type to Black List.
Add "Photobucket" and "toknowall" to the URL filter list.
Asus RT-AC66U
Asus RT-N56U (EOL)
Asus RT-N10 (EOL)
Asus RT-N10E (EOL)
Asus RT-N10U (EOL)
Asus RT-N66U
Other affected routers can be found here.
VPNFilter Malware is a new threat targeting a range of routers and network-attached storage (NAS) devices. It can render infected devices unusable and maintain a persistent presence even after a reboot.
Spying on Traffic: Monitors traffic routed through the device.
Theft of Website Credentials: Steals login information from websites.
Intercepting Traffic: Intercepts all traffic via port 80, allowing attackers to snoop and tamper with web traffic.
Downgrading Security: Changes HTTPS requests to HTTP, sending data insecurely.
Harvesting Sensitive Information: Collects credentials and other sensitive data from the network.
Destructive Capability: Can "brick" the device by overwriting firmware and rebooting.
Monitoring Modbus SCADA: Monitors specific industrial control protocols.
Taking these steps and understanding the malware's capabilities can help protect your network and devices from VPNFilter. You can see more information here.
