Loading ATT&CK
VPNFilter is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. VPNFilter modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) VPNFilter was assessed to be replaced by Sandworm Team with Cyclops Blink starting in 2019.(Citation: NCSC CISA Cyclops Blink Advisory February 2022)
Only techniques sit in a kill chain phase.
| Direction | Type | Related object |
|---|---|---|