www.belgium.be Logo of the federal government
Document

What is VPNFilter?

VPNFilter is a malware designed to infect routers and network attached storage (NAS) devices. Once installed VPNFilter will listen on your network and gather credential and other sensitive data which is then exfiltrated using the Tor network. In addition, it allows for the infected device to be used as the origin for subsequent attacks.

How can I identify the infected device?

Unfortunately, there is no easy way to tell if your router is infected with VPNFilter. If you are concerned, or suspect, that your router is infected with VPNFilter you should perform the steps in “How can I remove VPNFilter”.

How can I remove VPNFilter?

To remove the VPNFilter malware we recommend to contact your router manufacturer or provider. Should you want to remove the malware yourself you can perform the following steps:

  • Reset the router to factory settings
  • Upgrade to the latest firmware
  • Turn of remote administration in the settings
  • Change the admin passwords