MITRE ATT&CKsoftware (malware)

S0687 Cyclops Blink

Published 2022-03-03 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Network Devices
Version
1.2
Created
2022-03-03

Description

Cyclops Blink is a modular malware that has been used in widespread campaigns by Sandworm Team since at least 2019 to target Small/Home Office (SOHO) network devices, including WatchGuard and Asus. Cyclops Blink is assessed to be a replacement for VPNFilter, a similar platform targeting network devices.

Related

Uses · MITRE ATT&CK (21)

  • T1686.002 Network Device Firewall sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1572 Protocol Tunneling technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1132.002 Non-Standard Encoding sub-technique
  • T1571 Non-Standard Port technique
  • T1559 Inter-Process Communication technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.006 Timestomp sub-technique
  • T1037.004 RC Scripts sub-technique
  • T1542.002 Component Firmware sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1016 System Network Configuration Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (1)

  • G0034 Sandworm Team group

References