Thursday, April 18, 2024

Russia Based Cyclops Blink Malware Targeting ASUS Routers Models

ASUS has recently published a security advisory containing mitigation measures for the Russian-linked Cyclops Blink threat that has affected various of its router models. 

Several researchers suspect that Cyclops Blink, a modular botnet, was created by Sandworm/Voodoo Bear, a Russian APT group. In order to accumulate information about high-value targets for further attacks, the botnet’s purpose is to build an infrastructure.

While apart from this, its modularity means its scope is constantly refreshed, and it can exploit a larger range of devices.

Cyclops Blink Targets ASUS Routers

The U.K. and the U.S. intelligence agencies identify Cyclops Blink as a successor to VPNFilter, another malware that targets network devices like:- 

  • Small office/home office (SOHO) routers
  • Network Attachment Storage Devices (NAS)

Several multiple ASUS routers are targeted by the threat actors by exploiting the Cyclops Blink, and this malware allows the threat actors to read the flash memory to collect data about:-

  • Critical files
  • Executables
  • Confidential data
  • Libraries

Not only that, even upon receiving a command, the malware is told to nest in the flash memory, which is immutable even after the factory resets.

Since this malware has its root links with the elite hacking group, Sandworm, so, it’s likely possible that in the future, they could target the other router manufacturers as well.

Affected ASUS Routers

Here below we have mentioned all the affected or vulnerable ASUS routers:-

  • GT-AC5300 firmware under
  • GT-AC2900 firmware under
  • RT-AC5300 firmware under
  • RT-AC88U firmware under
  • RT-AC3100 firmware under
  • RT-AC86U firmware under
  • RT-AC68U, AC68R, AC68W, AC68P firmware under
  • RT-AC66U_B1 firmware under
  • RT-AC3200 firmware under
  • RT-AC2900 firmware under
  • RT-AC1900P, RT-AC1900P firmware under
  • RT-AC87U (EOL)
  • RT-AC66U (EOL)
  • RT-AC56U (EOL)

This malware creates a rule in Netfilter for all the hard-coded TCP ports that are used to communicate with the C&C servers. And under this rule, there are four parameters, and here they are mentioned below:-

  • Protocol: TCP
  • Chain: filter
  • Table: OUTPUT
  • Action: ACCEPT
  • Destination ports: 636, 994, and 995

However, when all these parameters are initialized, through pipes, they send all the essential information to the Cyclops’ modules, and they contain the following type of data:-

  • A “<p: ” string header.
  • The pipe of the core component.
  • All C&C IP addresses and ports.
  • Local IP address.
  • Interval for C&C server communication.
  • When the next packet to be sent to a C&C server is.
  • Main process PID.
  • A hard-coded ID.
  • Parameters are pushed to the modules, which are initialized at this point.

ASUS and WatchGuard devices have been infected with the malware since June 2019 in the following:-

  • U.S.
  • Canada
  • India
  • Italy
  • India
  • Russia

In Europe, hosts associated with a law firm, a mid-sized dental equipment manufacturer in Southern Europe, and a United States plumbing company were affected.

As a result of patches being infrequent and security software not being installed, the Internet of Things devices and routers are becoming lucrative targets for the threat actors. 

Due to these vulnerable factors, Trend Micro has warned that this could lead to the formation of “everlasting botnets.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles