The VPNFilter botnet, built by Russian cyberspies and infecting over 500,000 routers, was taken down by the FBI last week. But it is planning to return, according to telemetry data collected this week.
Security researchers at JASK and GreyNoise Intelligence revealed on Friday that they have evidence of such a plan to restart the VPNFilter campaign.
All scans involved Mikrotik routers with port 2000 exposed to the internet and only those located in Ukrainian networks.
The focus on this country is not surprising to researchers. The first version of the VPNFilter botnet targeted over 500,000 routers and NAS devices located around the world, but by May 8 it had begun specifically targeting Ukrainians.
The VPNFilter malware is considered one of the most advanced malware in circulation and consists of three different payloads.
The first stage payload can achieve boot persistence on devices and remain even after rebooting. The second stage involves a Remote Access Trojan while the third adds plugins for the RAT(Remote Access Trojan) giving it extra capabilities.
Most of these features are more common in malware that aims to damage a country's broader network rather than a single installation. This confirms an initial assessment by the FBI and the Department of Homeland Security that Russia's APT28 hacking group was behind the creation of this threat, and not one of the usual cybercriminals interested in launching DDoS attacks in exchange for some money.
A report by the Estonian Foreign Intelligence Service claims that APT28 is a unit of the Russian Military Intelligence Directorate (GRU). With the new VPNFilter on the horizon, Ukrainian authorities should remain on alert to thwart any cyberattacks.
