US and UK expose new Russian malware targeting network devices – The Record by Recorded Future

The US and UK governments have published a joint report today detailing a new malware strain developed by Russias military cyber-unit that had been deployed in the wild since 2019 and used to compromise home and office networking devices.

Agencies like the UK National Cyber Security Center (NCSC), the US Federal Bureau of Investigations (FBI), the US Cybersecurity Infrastructure and Security Agency (CISA), and the US National Security Agency (NSA) have contributed to thejoint report, complete with a technical analysis of the new malware, which they namedCyclops Blink[PDF].

Officials said theyve first seen the malware deployed in the wild in June 2019 and has been primarily detected targetingWatchGuard Firebox firewalls, but they dont exclude having the ability to infect other types of networking equipment too.

The UK and US officials said the malware was developed by a threat actor known asSandworm, previously linked to a cyber-unit of the GRU, Russias military intelligence division.

Officials described Cyclops Blink as professionally developed and said the malware uses a modular structure that allows its operators to deploy second-stage payloads to infected devices.

Details about how the malware is deployed on infected systems and what are the capabilities of its second-stage modules are not included in the report, but in its own security advisory on the matter, WatchGuard said they believe the attackers used a vulnerability in old Firebox firmware as the entry point, a vulnerability the company patched in May 2021.

Both US and UK officials said they believe that the Sandworm group developed Cyclops Blink to replace s previous botnet created using the older VPNFilter malware, botnet that the FBI sinkholedin late May 2018.

At the time, US officials and security firms said that Russian state-sponsored hackers were preparing to use the VPNFilter botnet to launch DDoS attacks in the hopes of disrupting the IT infrastructure of the UEFA Champions League 2018 final, which was scheduled to take place that year in Kyiv, Ukraine.

The timing of the joint report on Cyclops Blink report today is not an accident and comes as Russia is days away from sending troops into Ukraine, an operation that many security experts believe will be accompanied by cyber-attacks meant to disrupt Ukrainian IT infrastructure.

While it is unclear if Cyclops Blink is expected to play any role in these possible attacks, US and UK officials believed it was an opportune moment to expose the Cyclops Blink botnet, as a way to limit its usefulness to Russian military intelligence.

The report contains technical details that cybersecurity firms will be able to use to create detection rules for Cyclops Blink activity.

Because the malware also burrows deep inside a devices firmware, a simple device restart or factory reset wont remove it from infected firewalls. For this, WatchGuard has released tools to detect the malware on its devices, and steps on how to clean compromised systems.

According toNate Warfield, Chief Technology Officer at cybersecurity firm Prevailion, there aremore than 25,000 WatchGuard Firebox firewallscurrently connected to the internet. WatchGuard estimated the number of infected systems at around 1%, which would put the botnet size at around 250 devices.

However, only around a dozen of these 25,000 systems are located in Ukraine, meaning they cant be used by Sandworm operators to pivot into the internal networks of many Ukrainian companies, yet this doesnt mean the other Cyclops Blink devices cant be used for other types of operations, such as DDoS attacks.

Coincidentally, the joint report came out just as several Ukrainian government sites were under a DDoS attack, but there is no evidence that Cyclops Blink played any role in these attacks or that it can even carry out these types of operations.

Confirmed: #Ukraine's Ministry of Foreign Affairs, Ministry of Defense, Ministry of Internal Affairs, the Security Service of Ukraine and Cabinet of Ministers websites have just been impacted by network disruptions; the incident appears consistent with recent DDOS attacks pic.twitter.com/EVyy7mzZRr

Catalin Cimpanu is a cybersecurity reporter for The Record. He previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.

Read more:
US and UK expose new Russian malware targeting network devices - The Record by Recorded Future