Cyclops Blink

Cyclops Blink, a modular malware first identified in 2019, was designed to target network infrastructure. It was often referred to as the "Son of VPNFilter" due to its similarities with that campaign. The malware was specifically engineered to run on Linux systems, particularly those using the 32-bit PowerPC architecture. This malicious software was used predominantly for espionage and financial gain by creating proxy botnets that helped mask the origin of its illicit activities. In 2022, Cyclops Blink was found to be targeting Watchguard firewalls and ASUS routers, with attribution linked to the Russian Sandworm threat group. The malware was part of dedicated botnets, including Sandworm's own, which consisted of compromised Watchguard and ASUS routers. These botnets were subsequently disrupted by the FBI and the UK National Cyber Security Centre (NCSC). The malware was also implicated in attacks against Ukraine, where it was used alongside other botnets like VPNFilter. Following these disruptions, the malware was observed to shift tactics. After the dismantling of the Cyclops Blink botnet, the associated IP address was found to have been used in attacks against Danish energy firms in May, exploiting a vulnerability in Zyxel firewalls. These attacks were linked to the Katana Mirai botnet. The Department of Justice (DOJ) managed to take down the Russian GRU-backed botnet Cyclops Blink in April, marking a significant step in curtailing its activities. Despite these successes, the persistent use of routers for launching attacks by nation-state hackers continues to pose a serious cybersecurity concern.