Previously thought to be designed to deliver a DDoS attack, VPNFilter can alter data in transit and change what you see on your screen.

An article review.

Initially, researchers thought that a new piece of router-based malware called VPNFilter was a relatively simple tool for directing and implementing a distributed denial of service (DDoS) attack. Cleaning the malware out seemed similarly easy: the FBI recommended owners of vulnerable router models simple reboot their equipment. However, a closer look at the malware, as revealed in a Talos Intelligence blog entry submitted by our friend Wes Pollard, showed that VPNFilter was much more sophisticated than expected.

While rebooting equipment did appear to wipe out VPNFilter, it was discovered that the initial code that installs the exploit remains active, waiting for instructions on where to download the rest of the malware package. Additional functionality was also discovered in one of the malware’s “modules,” including code that looks for and captures certain data in network traffic, along with changing data that is being requested from a website.

In theory, this functionality could potentially allow an attacker to both capture banking credentials, and present a false account balance so the user would not realize their account was being drained. The malware could also use this capability to hide evidence of its existence in web-based device status pages, or show certain security functions as being activated when they are not.

For now, there have been no reports of this aspect of VPNFilter’s functionality being used in the wild, but it shows how the focus of malware is evolving as attacks become more sophisticated. It also serves as a reminder that even home and small business routers are computers that can be infected just like any other system–and that a compromised router can do far more damage than simply taking you offline.

Original article by Talos Intelligence.