https://blog.talosintelligence.com/2018/05/VPNFilter.html provides a detailed technical overview of how VPNFilter functions and their findings conclude it appears to be a derivative of similar efforts by the same group.

NCCIC released the following analysis last year with more on the topic: https://www.us-cert.gov/sites/default/files/publications/AR-...

Sophos published an article a month ago that warned about this exact scenario: https://nakedsecurity.sophos.com/2018/04/18/russias-grizzly-...