Log in Request a demo

Malware profile

Cyclops Blink

Cyclops Blink is modular malware that runs on small office and home office network devices, mainly WatchGuard devices.

In short

Cyclops Blink is modular malware that runs on small office and home office network devices, mainly WatchGuard devices. The UK and US governments say it has been deployed since at least June 2019 and attribute it to the Sandworm actor. It appears to replace the VPNFilter malware, and a US court-authorized operation cut part of its command layer off in March 2022.

Last updated 9 October 2026

Profile MapMalware
  1. Names1names in public reportsCyclops Blink
  2. Techniques17ATT&CK techniques listedPersistence · Stealth · Defense Impairment
  3. Infection Steps6in the delivery chainModified firmware · Persistence in firmware
  4. Linked Groups1groups that use itSandworm

In one minute

What it is
Modular malware for small office and home office network devices, mainly WatchGuard devices. Seen since at least June 2019, and described as a replacement for VPNFilter.
What it does
Reports device information to a command server, downloads and uploads files, runs downloaded files, and can add new modules while it runs. It hides as a Linux kernel process.
Who uses it
Attributed by the UK NCSC, CISA, the FBI and the NSA (advisory of 23 February 2022) to Sandworm, which they attribute to the Russian GRU. MITRE also lists Sandworm Team.
How it gets in
Most likely a modified firmware image delivered through an exposed service. Only WatchGuard devices set up to allow remote management from outside could be infected.
What to do first
Check that no network device has its management page open to the internet, then follow the detection steps and indicators in the NCSC malware analysis report.

What it does

The NCSC says Cyclops Blink is a large-scale framework with a core component and extra modules that run as child processes. The samples it studied were compiled for 32-bit PowerPC and were taken by the FBI from WatchGuard Firebox devices known to be in the botnet.

The joint advisory says an infection does not mean the organization is the main target, but it may be selected to be, or its machines could be used to conduct attacks. The US Department of Justice adds that these devices often sit on the edge of a network, which gives the actor a way toward the computers behind them.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
Cyclops BlinkMITRE ATT&CK software S0687, advisory AA22-054A and the NCSC malware analysis report[1, 2, 3, 4]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Persistence

  • Pre-OS Boot: Component Firmware T1542.002

    It keeps its place by patching the real device firmware as it is downloaded, including WatchGuard firmware.[1, 4]

  • Boot or Logon Initialization Scripts: RC Scripts T1037.004

    It starts when the device boots, using a changed startup script named S51armled.[1, 4]

Stealth

  • Masquerading: Match Legitimate Resource Name or Location T1036.005

    It renames its process to look like a Linux kernel thread, and named its startup scripts after WatchGuard files.[1, 4]

  • Indicator Removal: Timestomp T1070.006

    It can change the timestamps of modified firmware update images.[1]

  • Deobfuscate/Decode Files or Information T1140

    It can decrypt and read instructions that arrive from the command server.[1]

Defense Impairment

  • Disable or Modify System Firewall: Network Device Firewall T1686.002

    It changes the Linux iptables firewall so that its command traffic is allowed through a stored list of ports.[1, 4]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    It can download files over HTTP and HTTPS.[1, 4]

  • Proxy: Multi-hop Proxy T1090.003

    It has used Tor nodes for command traffic.[1, 3]

  • Data Encoding: Non-Standard Encoding T1132.002

    Its command messages use a custom binary format that carries the command and its parameters.[1, 4]

  • Encrypted Channel: Asymmetric Cryptography T1573.002

    It encrypts each command message with AES-256-CBC under TLS, using a random key that is protected by a built-in RSA public key.[1, 4]

  • Non-Standard Port T1571

    Its list of command ports includes ports not normally used for web traffic.[1, 4]

  • Ingress Tool Transfer T1105

    It can download files onto the infected device.[1]

Collection

  • Data from Local System T1005

    It can upload files from the infected device.[1]

Exfiltration

  • Exfiltration Over C2 Channel T1041

    It can upload files to its command server.[1, 4]

Discovery

  • System Information Discovery T1082

    It queries device information at regular intervals.[1, 4]

  • System Network Configuration Discovery T1016

    It uses the Linux call if_nameindex to collect network interface names.[1]

Execution

  • Inter-Process Communication T1559

    It creates pipes so its core part can talk to its modules.[1]

How it spreads

The joint advisory says the actors most likely deploy modified device firmware images by exploiting an externally available service, and that Cyclops Blink is generally deployed as part of a firmware update. It adds that only WatchGuard devices changed from the default settings to open remote management to outside access could be infected. The sources do not name a specific vulnerability.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Modified firmware

    The joint advisory says the actors most likely deploy modified device firmware images by exploiting an externally available service.[2]

  2. Persistence in firmware

    Cyclops Blink is generally deployed as part of a firmware update, which keeps it in place after a reboot and makes removal harder.[2]

  3. Startup

    It runs at device startup through a changed RC script and renames its process to look like a kernel thread.[4]

  4. Firewall change

    The core part changes the iptables firewall to allow traffic on its stored command ports, then starts four built-in modules.[4]

  5. Beaconing

    It sends queued messages to a command server at regular intervals, picked from a built-in list of addresses and ports.[2, 4]

  6. Tasking

    It decrypts and handles tasks from the server, including downloading files and adding new modules.[4]

Timeline

  1. May 2018

    VPNFilter botnet disruption

    The joint advisory says the US Department of Justice linked VPNFilter to Sandworm in May 2018 and announced efforts to disrupt that botnet.[3]

  2. June 2019

    Earliest Cyclops Blink deployment

    The advisory says Cyclops Blink has been deployed since at least June 2019, fourteen months after VPNFilter was disrupted.[3]

  3. 23 February 2022

    Joint advisory

    The NCSC, CISA, NSA and FBI published advisory AA22-054A and the NCSC malware analysis report on Cyclops Blink.[2, 3, 4, 5]

  4. 18 March 2022

    Court authorization

    The Department of Justice says the initial court authorization for its operation came on this date.[6]

  5. March 2022

    Court-authorized operation

    The Department of Justice says it copied and removed the malware from the remaining identified command devices and closed their external management ports.[6]

  6. 6 April 2022

    Operation announced

    The Department of Justice announced the operation, and said thousands of devices had been remediated but a majority of the originally compromised devices were still infected by mid-March.[6]

Detection and defense

  1. Use the official detection resources

    The NCSC malware analysis report on Cyclops Blink (23 February 2022) holds indicators of compromise, YARA rules and STIX files. The joint advisory AA22-054A points to it for detection.[2, 3, 4]

    Counters: T1542.002 T1037.004 T1036.005

  2. Keep management pages off the internet

    The advisory says to make sure the management interface of network devices is not exposed to the internet. Only WatchGuard devices opened to outside management could be infected.[2, 3]

    Counters: T1542.002

  3. Follow the device maker's removal steps

    The advisory says the maker worked with the FBI, CISA, NSA and NCSC on a detection and removal process. It says to follow each step so the device is patched to the latest version and any infection is removed.[2, 3]

    Counters: T1542.002 T1037.004

  4. Replace passwords on infected devices

    The advisory says to assume that passwords on an infected device are compromised and to replace them.[2, 3]

  5. Use multi-factor authentication

    The NCSC advises multi-factor authentication to reduce the impact of password compromises.[2]

  6. Keep devices up to date

    The NCSC advises using the latest supported versions and applying security patches promptly.[2]

  7. Set up security monitoring

    The NCSC advises collecting the data needed to analyze network intrusions. The malware analysis report notes C2 traffic is built to be hard to detect.[2, 4]

    Counters: T1573.002 T1071.001

  8. Report and ask for help

    UK organizations should report compromises to the NCSC. The Department of Justice says US owners who think a device is compromised should contact their local FBI field office.[2, 6]

Questions

What is Cyclops Blink?

The UK NCSC calls it a modular malware framework that targets small office and home office network devices. The joint advisory says it has been deployed since at least June 2019, mainly on WatchGuard devices.

Who is behind Cyclops Blink?

The NCSC, CISA, the FBI and the NSA attribute it to Sandworm, an actor they have previously attributed to the Russian GRU's Main Centre for Special Technologies (GTsST). The Department of Justice also describes Sandworm as previously attributed by the US government to the GRU.

Did the US take down the Cyclops Blink botnet?

Only in part. The Department of Justice says a court-authorized operation in March 2022 removed the malware from the command devices it identified. It did not involve access to the malware on the thousands of infected devices, which the Department says may stay vulnerable unless owners follow the removal steps.

Which devices could be infected?

The advisory says Cyclops Blink was mainly deployed to WatchGuard devices, and only those changed from the default settings to allow outside remote management could be infected. The Department of Justice says the malware targets devices made by WatchGuard and ASUS.

How can I check for it?

The NCSC malware analysis report lists indicators of compromise and carries YARA rules and STIX files. The advisory also points to the device maker's detection and removal tooling.

In our research

  1. Cyclops Blink Botnet Targets ASUS Routers and WatchGuard Devices March 2022
  2. Sandworm Threat group

Sources

  1. Cyclops Blink, Software S0687 MITRE ATT&CKSupports: Description, platform, techniques, alias list and Sandworm Team as user.
  2. New Sandworm malware Cyclops Blink replaces VPNFilter UK National Cyber Security CentreSupports: Joint advisory of 23 February 2022: attribution, deployment since June 2019, firmware deployment, mitigations.
  3. New Sandworm Malware Cyclops Blink Replaces VPNFilter, AA22-054A CISASupports: US copy of the joint advisory with the same findings, mitigations and technique table.
  4. Cyclops Blink Malware Analysis Report UK National Cyber Security CentreSupports: Technical analysis, persistence through firmware update, command channel, indicators, YARA.
  5. New Sandworm Malware Cyclops Blink Replaces VPNFilter (alert) CISASupports: CISA alert of 23 February 2022 announcing the advisory.
  6. Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation's Main Intelligence Directorate (GRU) US Department of JusticeSupports: Operation of March 2022, announced 6 April 2022.
  7. Sandworm Team, Group G0034 MITRE ATT&CKSupports: Sandworm Team group page.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Botnet

A botnet is a group of hijacked internet-connected devices that an attacker controls remotely and uses to carry out large scale attacks.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Technique

Masquerading

Masquerading is when an attacker changes how a file, program, service or account looks so it seems legitimate.

Read more