The Sality Malware family has been around since 2003 and has undergone many changes since that time. ESET researchers have found a component capable of changing a routers primary DNS server. The malware redirects searches for google and facebook to rogue servers that distribute Sality.A. The malware targets routers using common usernames and passwords. It seems likely that this Sality component will continue to advance, possibly in the form of fake login pages that steal user credentials.”]
Source: https://blog.malwarebytes.com/threat-analysis/2014/04/sality-malware-now-features-dns-changer/