Cisco Talos: VPNFilter malware capable of stealing data, infecting IoT endpoints

Cisco Talos warns that VPNFilter, previously known to compromise hundreds of thousands of SOHO routers and NAS devices (initially ~500,000 in 54 countries), is more widespread and has gained new capabilities: stage-3 modules can inject malicious content into web traffic to deliver exploits to endpoints (MITM), enable data exfiltration, and include destructive ‘brick’ functionality. The report expands the list of affected vendors (ASUS, D-Link, Huawei, Ubiquiti, UPVEL, ZTE, Linksys, MikroTik, Netgear, TP-Link), emphasizes that the threat extends beyond the devices into networks they support, and recommends endpoint AV, patching and multi-factor authentication as mitigations.