Cyclops Blink

"Cyclops Blink" is a type of modular malware that emerged in 2019, designed to target network infrastructure. It was dubbed the "Son of VPNFilter" due to its similarities with the latter campaign. Specifically crafted to run on Linux systems, particularly those with 32-bit PowerPC architecture, Cyclops Blink was used by advanced persistent threat (APT) actors to create dedicated botnets. These botnets primarily consisted of compromised Watchguard and ASUS routers, marking an increase in nation-state hackers' reliance on routers for launching attacks. In 2022, the malware notably targeted Watchguard firewalls and ASUS routers and was attributed to the Russian Sandworm threat group. The botnet, Cyclops Blink, was backed by the Russian GRU and was disrupted by the combined efforts of the FBI and the UK National Cyber Security Centre (NCSC). Despite this disruption, the trend of using routers as launchpads for attacks continued, with instances like VPNFilter, Cyclops Blink, and KV-botnet signaling an ongoing issue. The impact of Cyclops Blink extended beyond its initial targets. For example, in May, attacks against Danish energy firms exploited a Zyxel firewall vulnerability, involving an IP address associated with the Katana Mirai botnet. This was after the disruption of the Cyclops Blink botnet used by Russian hackers. Furthermore, researchers discovered that the IP used in these attacks previously belonged to Cyclops Blink, suggesting a potential connection between different threat campaigns.