Sandworm Team using a new modular malware Cyclops Blink

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The National Cyber Security Centre (NCSC) in the United Kingdom, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) have discovered that the Sandworm actor is employing a new malware known as Cyclops Blink. Cyclops Blink looks to be a replacement framework for the VPNFilter virus, which was first discovered in 2018 and targeted network equipment such as SOHO routers and network attached storage (NAS) devices. Cyclops Blink is a malicious Linux ELF program that has been developed for the PowerPC (big-endian) 32-bit architecture. It can maintain persistence all throughout the legitimate device firmware update process. The malware has implemented a modular architecture with a core component and is able to execute additional modules as child processes. It has built in modules for downloading or uploading data, extracting device information, and updating the virus and run upon startup. Underneath TLS, a custom binary protocol for command and control (C2) communication is used, and messages are individually encrypted. WatchGuard thinks the threat actor exploited a previously identified and fixed vulnerability (CVE-2022-23176) that was only available when firewall appliance management policies were set to enable unlimited management access from the Internet. The vulnerability was resolved in these Fireware releases: Fireware v12.8, Fireware v12.7 Update 1, Fireware v12.7.2 Update 1 or later, Fireware v12.5.7 Update 3 or later, and Fireware v12.1.3 Update 5 or later. The Mitre TTPs used by Cyclops Blink malware are: TA0002 - Execution TA0003 - Persistence TA0005 - Defense Evasion TA0007 - Discovery TA0011 - Command and Control TA0010 - Exfiltration T1059.004: Command and Scripting Interpreter: Unix Shell T1037.004: Boot or Logon Initialization Scripts: RC Scripts T1542.001: Pre-OS Boot: System Firmware T1562.004: Impair Defenses: Disable or Modify T1036.005: Masquerading: Match Legitimate Name or Location T1082: System Information Discovery T1132.002: Data Encoding: NonStandard Encoding T1008 Fallback Channels T1071.001: Application Layer Protocol: Web Protocols T1573.002: Encrypted Channel: Asymmetric Cryptography T1571: Non-Standard Port T1041: Exfiltration Over C2 Channel Actor Detail Vulnerability Detail Indicators of Compromise (IoCs) Patch Fireware Release Notes - Upgrade to Fireware v12.7 Update 1 (watchguard.com) References https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf