Sandworm Team using a new modular malware Cyclops Blink

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here

The National Cyber Security Centre (NCSC) in the United Kingdom, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) have discovered that the Sandworm actor is employing a new malware known as Cyclops Blink. Cyclops Blink looks to be a replacement framework for the VPNFilter virus, which was first discovered in 2018 and targeted network equipment such as SOHO routers and network attached storage (NAS) devices.

Cyclops Blink is a malicious Linux ELF program that has been developed for the PowerPC (big-endian) 32-bit architecture. It can maintain persistence all throughout the legitimate device firmware update process. The malware has implemented a modular architecture with a core component and is able to execute additional modules as child processes. It has built in modules for downloading or uploading data, extracting device information, and updating the virus and run upon startup. Underneath TLS, a custom binary protocol for command and control (C2) communication is used, and messages are individually encrypted. WatchGuard thinks the threat actor exploited a previously identified and fixed vulnerability (CVE-2022-23176) that was only available when firewall appliance management policies were set to enable unlimited management access from the Internet.

The vulnerability was resolved in these Fireware releases: Fireware v12.8, Fireware v12.7 Update 1, Fireware v12.7.2 Update 1 or later, Fireware v12.5.7 Update 3 or later, and Fireware v12.1.3 Update 5 or later.

The Mitre TTPs used by Cyclops Blink malware are:

TA0002 – Execution       

TA0003 – Persistence       

TA0005 – Defense Evasion       

TA0007 – Discovery       

TA0011 – Command and Control

TA0010 – Exfiltration

T1059.004: Command and Scripting Interpreter: Unix Shell

T1037.004: Boot or Logon Initialization Scripts: RC Scripts

T1542.001: Pre-OS Boot: System Firmware

T1562.004: Impair Defenses: Disable or Modify

T1036.005: Masquerading: Match Legitimate Name or Location

T1082: System Information Discovery

T1132.002: Data Encoding: NonStandard Encoding

T1008 Fallback Channels

T1071.001: Application Layer Protocol: Web Protocols

T1573.002: Encrypted Channel: Asymmetric Cryptography

T1571: Non-Standard Port T1041: Exfiltration Over C2 Channel

Actor Detail

Vulnerability Detail

Indicators of Compromise (IoCs)

Patch

Fireware Release Notes – Upgrade to Fireware v12.7 Update 1 (watchguard.com)

References

https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf