The US Justice Department in March carried out an operation that successfully removed malware known as “Cyclops Blink” from vulnerable internet-connected firewall devices, the department announced Wednesday. The operation disrupted the control the Russian Federation’s Main Intelligence Directorate (GRU) had over a global botnet of thousands of infected devices.
ZDNet Recommends
While robust passwords help you secure your valuable online accounts, hardware-based two-factor authentication takes that security to the next level.
The Cyclops Blink Malware specifically targeted WatchGuard and Asus network devices. A threat actor known as Sandworm (which the US government previously attributed to the GRU) used the malware for command and control of the underlying botnet. By disabling the command and control mechanism, the Justice Department was able to sever Sandworm from the network of bots.
However, WatchGuard and Asus devices that acted as bots may remain vulnerable to Sandworm if device owners do not take the remediation steps advised by WatchGuard and Asus, the Justice Department warned.
Various DOJ agencies, as well as the US National Security Agency and the UK’s National Cyber Security Centre, first released an advisory on Feb. 23 identifying the Cyclops Blink malware. The advisory explained that the malware appeared to have emerged as early as June 2019, as the apparent successor to another Sandworm botnet the DOJ took down in 2018.
The same day as the advisory, WatchGuard released detection and remediation tools for users of WatchGuard devices. Later, Asus released its own guidance to help compromised Asus device owners. By mid-March, however, a majority of the originally compromised devices remained infected.
The DOJ’s subsequent operation removed the malware from all the remaining identified command-and-control devices. The operation used direct communications with the Sandworm malware. Other than collecting the underlying command-and-control devices’ serial numbers through an automated script and copying the malware, the DOJ did not search for or collect information from the relevant victim networks, the department said. Furthermore, the operation didn’t involve any FBI communications with bot devices.
The DOJ operation demonstrated “the department’s commitment to disrupt nation-state hacking using all of the legal tools at our disposal,” Assistant Attorney General Matthew G. Olsen said in a statement. “By working closely with WatchGuard and other government agencies in this country and the United Kingdom to analyze the malware and to develop detection and remediation tools, we are together showing the strength that public-private partnership brings to our country’s cybersecurity. “
