CyclopsBlink
- First seen
- 2019-06-01 00:00:00
- Malware type
- botnet
- Family
- Malware family
- Profile updated
- 2026-07-07 12:44:33
Targeted industries: technology-and-telecommunications
Context
According to CISA, Cyclops Blink appears to be a replacement framework for the VPNFilter malware exposed in 2018, and which exploited network devices, primarily small office/home office (SOHO) routers and network attached storage (NAS) devices. Cyclops Blink has been deployed since at least June 2019, fourteen months after VPNFilter was disrupted. In common with VPNFilter, Cyclops Blink deployment also appears indiscriminate and widespread. The actor has so far primarily deployed Cyclops Blink to WatchGuard and ASUS devices, but it is likely that Sandworm would be capable of compiling the malware for other architectures and firmware.
Detection coverage
- 7 YARA rules
Detection rules
- SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Notable_Strings (yara-rule)
- SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Module_Initialisation (yara-rule)
- SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Modified_Install_Upgrade (yara-rule)
- SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Config_Identifiers (yara-rule)
- SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0Xf_Command (yara-rule)
- SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Default_Config_Values (yara-rule)
- SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0X51_Command (yara-rule)
Reports & references
- MITRE ATT&CK — G0034 (report)
- splunk.com — Strt Ta03 Cpe Destructive Software (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Cyclops Blink (report)
- theregister.com — Cyclops Asus Routers (report)
- Trend Micro — Appendix Cyclops%20Blink%20Sets%20Sights%20On%20Asus%20Routers (report)
- bleepingcomputer.com — Us Disrupts Russian Cyclops Blink Botnet Before Being Used In Attacks (report)
- inquest.net — Ukraine Cyberwar Overview (report)
- CISA — Aa22 054A (report)
- justice.gov — Justice Department Announces Court Authorized Disruption Botnet Controlled Russian Federation (report)
- Trend Micro — Cyclops Blink Sets Sights On Asus Routers (report)
- bleepingcomputer.com — Cisa Warns Orgs Of Watchguard Bug Exploited By Russian State Hackers (report)
- justice.gov — Attorney General Merrick B Garland Announces Enforcement Actions Disrupt And Prosecute (report)
- bleepingcomputer.com — Asus Warns Of Cyclops Blink Malware Attacks Targeting Routers (report)
- justice.gov — Download (report)
- shadowserver.org — Shadowserver Special Reports Cyclops Blink (report)
- github.com — Check.Py (report)