Cyclops Blink is a botnet that infects small office and home routers, mainly WatchGuard Firebox and ASUS devices. Government agencies link it to Sandworm, a group tied to Russian military intelligence, and it has been active since at least 2019. Owners should apply updates and keep device management interfaces off the internet. See also the Cyclops Blink and KV botnet malware pages.
What is Cyclops Blink?
Cyclops Blink Botnet, which is associated with Russian state-backed Sandworm APT, has been found to target Asus Routers and WatchGuard Firebox devices with a new attack campaign. A statement on the Cyclops Botnet has recently been published in a joint effort by the UK National Cyber Security Center (NCSC), CISA, NSA, and FBI.
How does the Cyclops Blink botnet work?
Active since at least June 2019, the Cyclops Blink Botnet is Linux malware that communicates with its command and control (C2) server using a custom protocol underneath TLS. The malware uses OpenSSL functions to encrypt each message it sends. In addition, Cyclops Blink includes built-in modules responsible for system reconnaissance, downloading and uploading files, and updating the malware. The main modules are as follows;
What do the Cyclops Blink modules do?
System Reconnaissance (0x08): This module is responsible for sending information from infected devices to the C&C server. Some information from an infected device is as follows;
- Current Linux version,
- Memory consumption information belongs to the device
- The content of the following files;
- /etc/passwd,
- /etc/group,
- /proc/mounts,
- /proc/partitions
- The information about the network interfaces.
File Download (0x0f): This module is responsible for downloading files to the device and uploading files to the C&C server.
How can you protect your router from Cyclops Blink?
Owners of affected devices should apply the latest updates immediately. CISA advises not to expose the management interfaces of network devices to the internet, so keep the Remote Management function disabled.