Cyclops Blink
Cyclops Blink is malware that targets routers and firewall devices from WatchGuard and ASUS and adds them to a botnet for command and control (C&C).
Infection is through an exploit with the code CVE-2022-23176, which allows a privilege escalation to obtain management ability on the device.[1] After a device has been infected, it acts as a command and control server, and its software design allows for further modules to be installed and be resilient to firmware upgrades.
Cyclops Blink was first reported on in February of 2022 after security advisories published by the United Kingdom's National Cybersecurity Centre (NCSC) and the United States' Cybersecurity and Infrastructure Security Agency (CISA) detailed its presence in the wild. According to those agencies, the malware originates from the hacker group Sandworm, a team within the GRU, a military intelligence unit of the Russian Federation.
The malware has drawn comparison to the earlier VPNFilter based on the shared origin and its similar operation of attacking network devices. According to the cyber security firm Trend Micro Inc., the malware has been around since at least June 2019. Thousands of routers were cleaned.[2] Although Sandworm has attacked Ukrainian assets in the past, the malware has not targeted Ukrainian networking equipment and is thought to be unrelated to the Russo-Ukrainian War.[3][4][5][6][7]
References
- ↑ "Security Portal - Threat". https://securityportal.watchguard.com/threats/detail?ruleId=1230677&sigVers=18.
- ↑ Conger, Kate; Sanger, David E. (6 April 2022). "U.S. Says It Secretly Removed Malware Worldwide, Pre-empting Russian Cyberattacks". https://www.nytimes.com/2022/04/06/us/politics/us-russia-malware-cyberattacks.html.
- ↑ Greenberg, Andy. "Russia's Sandworm Hackers Have Built a Botnet of Firewalls". Wired. https://www.wired.com/story/sandworm-cyclops-blink-hacking-tool/. Retrieved 21 March 2022.
- ↑ Hacquebord, Feike; Hilt, Stephen; Merces, Fernando (17 March 2022). "Cyclops Blink Sets Sights on Asus Routers". Trend Micro Inc.. https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html.
- ↑ "New Sandworm Malware Cyclops Blink Replaces VPNFilter". Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/uscert/ncas/alerts/aa22-054a.
- ↑ Osborne, Charlie. "Russian Cyclops Blink botnet launches assault against Asus routers" (in en). https://www.zdnet.com/article/cyclops-blink-botnet-launches-assault-against-asus-routers/.
- ↑ Arntz, Pieter (2022-02-24). "Cyclops Blink malware: US and UK authorities issue alert" (in en-US). https://blog.malwarebytes.com/threat-spotlight/2022/02/cyclops-blink-malware-us-and-uk-authorities-issue-alert/.
External links
![]() | Original source: https://en.wikipedia.org/wiki/Cyclops Blink.
Read more |