MITRE ATT&CKsoftware (malware)

S1010 VPNFilter

Published 2019-03-26 Modified 2025-04-15 Official page ↗
Domain
enterprise, ics
Platforms
Network Devices, Linux
Version
2.1
Created
2019-03-26

Description

VPNFilter is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. VPNFilter modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. VPNFilter was assessed to be replaced by Sandworm Team with Cyclops Blink starting in 2019.

Related

Uses · MITRE ATT&CK (3)

  • T0830 Adversary-in-the-Middle technique
  • T0842 Network Sniffing technique
  • T1561.001 Disk Content Wipe sub-technique

Referenced by MITRE ATT&CK · uses (1)

  • G0034 Sandworm Team group

References