destructive 'vpnfilter'

RouterOS General
1

I have seen several online story’s circulating that state their is a new router malware circulating…

in particular they mention Mikrotik Versions 1016, 1036, and 1072
im unaware of their being any sort of versions along these lines does anyone know other wise?


https://www.symantec.com/blogs/threat-intelligence/vpnfilter-iot-malware

thanks.

2

My guess is that they are referring to the hardware CCR1016, CCR1036, and CCR1072, which I think is what they tested against.

I haven’t seen any version numbers of RouterOS that are affected, but my guess would be that the versions are prior to the latest fixes they have put out. From what I was reading, it mostly affects older versions of software, and not necessarily the latest versions.

3

here is the Cisco Talos post about it:
https://blog.talosintelligence.com/2018/05/VPNFilter.html

4

They mean RouterOS as used on CCR models 1016, 1036, 1072, and other Mikrotik products. This is already being discussed at http://forum.mikrotik.com/t/vpnfilter-malware/119744/1