500,000 Routers Are Infected With Malware and Potentially Spying On Users

Half a million routers and NAS devices are infected with VPNFilter, serious malware that can spy on network traffic and even survive a reboot.

VPNFilter can only be completely removed with either a software update or a factory reset of the router. The motivations for this malware aren’t clear, but according to a Cisco blog post it’s particularly prevalent in Ukraine.

Symantec said in a blog post that VPNFilter is primarily targeting home and small business routers. 

Here’s a list of devices known to have been infected:

1. Linksys E1200
2. Linksys E2500
3. Linksys WRVS4400N
4. Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072
5. Netgear DGN2200
6. Netgear R6400
7. Netgear R7000
8. Netgear R8000
9. Netgear WNR1000
10. Netgear WNR2000
11. QNAP TS251
12. QNAP TS439 Pro
13. Other QNAP NAS devices running QTS software
14. P-Link R600VPN

If you have one of these you should consider doing a factory reset. As we’ve outlined before this usually means holding down the “Reset” button for 10 seconds, but the exact instructions will vary depending on your router. Note that you’ll lose all of your custom settings by doing this, meaning you’ll need to configure everything again.

Be sure to make sure your router is getting security updates after the factory reset, to prevent more infections in the future. Your router is the entry point to your home network, after all, so you want to make sure it’s secure.