4 ms·

Dumb question about this malware... with so many infected routers, why was this not noticed sooner? Just monitoring incoming/outgoing data should reveal that th

• joewee 8y ago
  No one was looking? It looks like the deployment was fairly sophisticated, these typically use things like twitter, instagram to send commands to compromised devices. These tend to only be discovered when they are used to attack a target or when someone happens upon a C&C machine.
• jlgaddis 8y ago
  IIRC, previous articles (a few weeks ago) stated that Cisco (at least, and possibly others) have known about and been “tracking” this for months but they finally announced it publicly because $someEvent was approaching and they were afraid this botnet would be used to disrupt it. (I’m on my phone or else I’d look into this more and give you more specific info instead of vague recollections but, if you (or anyone else here) are interested, this should at least give you somewhere to start.)
• teilo 8y ago
  It was noticed by some vendors. They just didn't know what it was. Mikrotik, for example, posted a warning on their forums months ago, when their users noticed a sudden uptick in attempt to get at ports 80 and 8291. In this case the attack was scanning for the existence of port 8291 to identify these routers, and then attempting an exploit on port 80. It was only months later that we all learned the VPNFilter was the culprit.