malware

VPNFilter S1010

Type: malware
Platforms: Network Devices, Linux
Created: 26 March 2019
Last modified: 15 April 2025

VPNFilter is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. VPNFilter modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. [1] [2] VPNFilter was assessed to be replaced by Sandworm Team with Cyclops Blink starting in 2019.[3]

TechniqueBottom 5%

TacticBottom 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

malware

VPNFilter S1010

Type: malware
Platforms: Network Devices, Linux
Created: 26 March 2019
Last modified: 15 April 2025

TechniqueBottom 5%

TacticBottom 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

VPNFilter MITRE reference S1010

Disk Content Wipe T1561.001 ↗

VPNFilter has the capability to wipe a portion of an infected device's firmware.4

Impact2 detection rules

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
		See what files are being deleted from flash file systems	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Disk Wipe Disk Content Wipe Disk Structure Wipe Stealth Indicator Removal File Deletion	-	medium	Austin Clark	2019-08-12	2023-01-04	71d65515-c436-43c0-841b-236b1f32c21e	-
Splunk		The following analytic detects a high volume of "wipe ManagedDevice" events from the Intune admin portal (5+ per hour by default). (...)	Generic	stable	cloud_audit	-	Azure	Impact Disk Wipe Disk Content Wipe	-	medium	Jake Enea	2026-04-15	2026-05-13	c3f48aa9-878e-443f-8889-e42a11a9bea9

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
		See what files are being deleted from flash file systems	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Disk Wipe Disk Content Wipe Disk Structure Wipe Stealth Indicator Removal File Deletion	-	medium	Austin Clark	2019-08-12	2023-01-04	71d65515-c436-43c0-841b-236b1f32c21e	-
Splunk		The following analytic detects a high volume of "wipe ManagedDevice" events from the Intune admin portal (5+ per hour by default). (...)	Generic	stable	cloud_audit	-	Azure	Impact Disk Wipe Disk Content Wipe	-	medium	Jake Enea	2026-04-15	2026-05-13	c3f48aa9-878e-443f-8889-e42a11a9bea9

VPNFilter S1010

VPNFilter S1010

VPNFilter MITRE reference S1010

VPNFilter MITRE reference S1010

Standing S1010

Reach

Coverage

VPNFilter detections S1010

VPNFilter detections S1010