VPNFilter Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
3
occurrences
First Seen
October 31, 2025
Last Seen
May 14, 2026

VPNFilter is a modular, router-focused malware family that infected a broad set of consumer and small-business devices to create a resilient botnet capable of command-and-control, data exfiltration, and remote manipulation.

Overview

VPNFilter is a modular, router-focused malware family that infected a broad set of consumer and small-business devices to create a resilient botnet capable of command-and-control, data exfiltration, and remote manipulation. It is notable for its multi-stage architecture, cross-vendor impact, and potential for long-lived network compromise. In the provided article, VPNFilter is not mentioned; the report instead covers BadCandy implant activity affecting Australian devices.

Related Threat Clusters

Recent Intelligence Reports

  • 621822 — www.cybersecuritydive.com · May 14, 2026
  • Srsly Risky Biz: US Vows to Fight Distillation Attacks — News.Risky.Biz · April 30, 2026
  • Hundreds of Australian Devices Compromised with BadCandy Implant — Thecyberexpress · October 31, 2025

CVSS v3.1 Breakdown