Cyclops Blink Malware

THE THREAT

On February 23rd, the U.K. National Cyber Security Centre (NCSC), in coordination with CISA, the FBI, and the NSA, released a report on a recently identified malware type that is being deployed by Russian state-sponsored threat actors. The malware has been dubbed Cyclops Blink, and it has been in active use since at least 2019. Cyclops Blink is a modular malware and has been identified as impacting WatchGuard SOHO devices; the malware primarily acts as a beacon for information to be sent back to an attacker-controlled server, but additional modules may allow for a range of malicious actions.

Cyclops Blink is reported to be widely and indiscriminately deployed, meaning all industries are at risk of impact. Organizations are strongly recommended to review and apply the recommendations in this advisory as attacks involving Cyclops Blink are ongoing.

What we’re doing about it

• Known attacker infrastructure has been blocked via eSentire’s global deny list
• Threat hunts have been performed for indicators associated with the Cyclops Blink malware
• eSentire MDR for Endpoint detections for Cyclops Blink are in development
• Detections to identify known Russian APT tools and techniques are in place across both eSentire MDR for Endpoint and Network products
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• Employ the WatchGuard tools for identifying potential Cyclops Blink infections
• Ensure internet facing systems are up to date on security patches
  • Vulnerabilities known to be exploited by Russian APT groups should be prioritized for patching
• Enforce the use of Multi-Factor Authentication (MFA) for all externally facing services
• Use a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) product to detect and contain threats
  • Ensure visibility into all critical assets is in place

Additional information

Cyclops Blink is a highly advanced piece of malware that is in active use in ongoing campaigns. Beyond allowing persistent access to victim devices, additional Cyclops Blink modules may be installed to allow for traffic manipulation, data destruction, and movement to other devices. Cyclops Blink is deployed as part of a firmware update to allow for persistence, despite rebooting impacted devices. While this malware has been identified impacting WatchGuard SOHO devices, it is highly likely that other SOHO devices may be impacted.

The malware has been attributed to the Sandworm APT group (ie. Electrum, Telebots, BlackEnergy, Voodoo Bear). Sandworm has been active since at least 2009 and has been attributed to a military unit in Russia’s GRU. Specific impacted victims have not been made public at this time. Cyclops Blink is believed to be the successor to the now defunct VPNFilter malware.

The geopolitical tensions between Ukraine and Russia continue to increase. Along with this escalation comes reports of Russian state-sponsored attacks against both Ukrainian interests and Western allied nations. As the conflict continues, organizations should expect a high volume of Russian threat actor activity. This activity may impact organizations in Ukraine, Ukrainian allied countries, businesses involved in critical infrastructure and finance, military production and contractors, and think-tanks.

eSentire is aware of reports of Distributed Denial of Service (DDoS) attacks impacting Ukrainian government and financial institutions as of February 23, 2022; the eSentire Threat Intelligence team is actively tracking this topic as well as other incidents relating to current geopolitical tensions.

References:

[1] https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter
[2] https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
[3] https://detection.watchguard.com/
[4] https://www.cisa.gov/uscert/ncas/alerts/aa22-011a
[5] https://attack.mitre.org/groups/G0034/
[6] https://www.reuters.com/world/europe/ukrainian-government-foreign-ministry-parliament-websites-down-2022-02-23/