TF-MAL-elf.vpnfilter

Description

ThreatFox malware family `elf.vpnfilter`. Printable name: VPNFilter.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Cyclops Blink, Software S0687 | MITRE ATT&CK®
  web:attack.mitre.org

  Cyclops Blink is a modular malware that has been used in widespread campaigns by Sandworm Team since at least 2019 to target Small/Home Office (SOHO) network devices, including WatchGuard and Asus. Cyclops Blink is assessed to be a replacement for VPNFilter , a similar platform targeting network devices. [1] [2] [3]

  2026-05-22 05:24 UTC
• VPNFilter - Wikipedia
  web:en.wikipedia.org

  VPNFilter is malware that infects a number of different kinds of network routers and storage devices. It seems to be designed in part to target serial networking devices using the Modbus protocol to talk to and control industrial hardware, as in factories and warehouses.

  2026-05-22 05:24 UTC
• VPNFilter (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the VPNFilter malware family including references, samples and yara signatures.

  2026-05-22 05:24 UTC
• Cyclops Blink Malware Used by Sandworm APT Group Replaces VPNFilter As ...
  web:socprime.com

  The threat can persist the device reboot, which makes its mitigation a sophisticated task. The inquiry by FBI, CISA, NSA, and UK NCSC states that Cyclops Blink impacts only WatchGuard network devices. Presumably, the malware developers reverse-engineered the WatchGuard Firebox firmware update mechanism to check for possible flaws and exploit them.

  2026-05-22 05:24 UTC
• PDF THREAT BULLETINS - American Hospital Association
  web:www.aha.org

  Health-ISAC is issuing a threat bulletin regarding this alert, with additional technical details, indicators of compromise (IOCs), and remediations strategies attached. The original alert, AA22-054A: New Sandworm Malware Cyclops Blink Replaces VPNFilter , can be accessed here.

  2026-05-22 05:24 UTC
• New Sandworm Malware Cyclops Blink Replaces VPNFilter - CISA
  web:www.cisa.gov

  This advisory summarizes the VPNFilter malware it replaces, and provides more detail on Cyclops Blink, as well as the associated tactics, techniques and procedures (TTPs) used by Sandworm. An NCSC malware analysis report on Cyclops Blink is also available. It also provides mitigation measures to help organizations defend against malware .

  2026-05-22 05:24 UTC
• AA22-054A: New Sandworm Malware Cyclops Blink Replaces VPNFilter
  web:www.defendedge.com

  This advisory summarizes the VPNFilter malware it replaces, and provides more detail on Cyclops Blink, as well as the associated tactics, techniques and procedures (TTPs) used by Sandworm. An NCSC malware analysis report on Cyclops Blink is also available. It also provides mitigation measures to help organizations defend against malware .

  2026-05-22 05:24 UTC
• VPNFilter Malware Analysis on Cyber Threat in Smart Home Network - MDPI
  web:www.mdpi.com

  The rest of this paper is organized as follows: Section 2 describes the taxonomy of malware in the smart home network; Section 3 discusses VPNFilter malware in the smart home network; Section 4 describes the impact on the smart home network as well as physical, cyber-security, and daily life impacts; Section 5 discusses the open issues ...

  2026-05-22 05:24 UTC
• New Sandworm malware Cyclops Blink replaces VPNFilter
  web:www.ncsc.gov.uk

  This advisory summarises the VPNFilter malware it replaces, and provides more detail on Cyclops Blink, as well as the associated tactics, techniques and procedures (TTPs) used by Sandworm. An NCSC malware analysis report on Cyclops Blink is also available and can be read in parallel.

  2026-05-22 05:24 UTC
• New Sandworm malware Cyclops Blink replaces VPNFilter
  web:www.wired-gov.net

  The malware dubbed Cyclops Blink appears to be a replacement for the VPNFilter malware exposed in 2018, and its deployment could allow Sandworm to remotely access networks.

  2026-05-22 05:24 UTC

Only Available for Registered Users. Sign in to view.