Hackers linked to the Russian military are exploiting security vulnerabilities in firewalls to compromise network and infect them with malware, allowing them to remotely gain access.
An alert by the UK National Cyber Security Centre (NCSC), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) has detailed the new malware, Cyclops Blink, attributing it to Sandworm, an offensive hacking operation they’ve previously linked to Russia’s GRU.
Analysis by the NCSC describes Cyclops Blink as a “a highly sophisticated piece of malware” which has been “professionally developed”.
Cyclops Blink appears to be a replacement for VPNFilter, malware which was used by state-linked Russian hacking groups in widespread attacks used to compromise network devices, predominantly routers, in order to access networks.
According to the NCSC, CISA, FBI and NSA, Cyclops Blink has been active since at least June 2019, and like VPNFilter before it, the targeting is described as “indiscriminate and widespread” with the ability to gain persistent remote access to networks.
It can also upload and download files from infected machines and it’s modular, allowing new functionality to be added to malware which is already running.
The cyber attacks are primarily focused on WatchGuard firewall devices, but the agencies warned that Sandworm is capable of re-purposing the malware to spread it via other architectures and firmware.
Cyclops Blink persists on reboot and throughout the legitimate firmware update process. It targets WatchGuard devices that were reconfigured from the manufacturer default settings to open remote management interfaces to external access.
An infection doesn’t mean the organisation is the primary target, but it’s possible that infected machines could be used to conduct additional attacks.
The NCSC urges affected organisation to take steps to remove the malware, which have been detailed by WatchGuard.
“Working closely with the FBI, CISA, DOJ, and UK NCSC., WatchGuard has investigated and developed a remediation for Cyclops Blink, a sophisticated state-sponsored botnet, that may have affected a limited number of WatchGuard firewall appliances,” said a WatchGuard statement.
“WatchGuard customers and partners can eliminate the potential threat posed by malicious activity from the botnet by immediately enacting WatchGuard’s 4-Step Cyclops Blink Diagnosis and Remediation Plan,” it added.
The NCSC warned that any passwords present on a device infected by Cyclops Blink should be assumed to be compromised and should be changed.
Other advice about protecting networks from cyber attacks includes avoiding the exposure of management interfaces of network devices to the internet, keeping devices up to date with the latest security patches and using multi-factor authentication.
The NCSC notes that the advisory is not directly linked to the current situation in Ukraine.
