U.S., U.K. Agencies Warn of New Russian Botnet Built from Hacked Firewall Devices

Intelligence agencies in the U.K. and the U.S. disclosed details
of a new botnet malware called Cyclops Blink
that’s been attributed to the Russian-backed Sandworm hacking group
and deployed in attacks dating back to 2019.

“Cyclops Blink appears to be a replacement framework for the
VPNFilter malware exposed in 2018, which exploited network devices,
primarily small office/home office (SOHO) routers, and
network-attached storage (NAS) devices,” the agencies said^[1]. “In common with
VPNFilter, Cyclops Blink deployment also appears indiscriminate and
widespread.”

The joint government advisory^[2] comes from the U.K.
National Cyber Security Centre (NCSC), the Cybersecurity and
Infrastructure Security Agency (CISA), the National Security Agency
(NSA), and the Federal Bureau of Investigation (FBI) in the
U.S.

Sandworm^[3], aka Voodoo Bear, is the
name assigned to a highly advanced adversary^[4] operating out of Russia
that’s known to be active since at least 2008. The hacking group
has displayed a particular focus on targeting entities in Ukraine
and is alleged to be behind the Ukrainian energy sector attacks
that caused widespread power outages in late 2015.

The threat actor, in October 2020^[5], was formally linked^[6]
to Russia’s General Staff Main Intelligence Directorate (GRU) Main
Center for Special Technologies (GTsST) military unit 74455.

VPNFilter was first documented^[7]
by Cisco Talos in May 2018, describing it as a “sophisticated
modular malware system” that shares overlaps with the Sandworm’s
BlackEnergy^[8]
malware and features capabilities to support
intelligence-collection and destructive cyber attack
operations.

The IoT botnet malware was found to have compromised more than
500,000 routers in at least 54 countries, targeting devices from
Linksys, MikroTik, NETGEAR, and TP-Link, ASUS, D-Link, Huawei,
Ubiquiti, QNAP, UPVEL, and ZTE.

That same month, the U.S. government announced^[9]
the seizure and takedown of a key internet domain used for the
attacks, urging owners of SOHO and NAS appliances that may be
infected to reboot their devices to temporarily disrupt the
malware.

As of January 2021, an analysis^[10] from Trend Micro
identified “residual infections” still remaining on thousands of
networks years after sinkholing VPNFilter, even as the Sandworm
actor simultaneously opted to retool the malware in response to
public disclosures.

Cyclops Blink, as the substitute is called, is believed to have
been in action since at least June 2019 primarily setting its eyes
on WatchGuard firewall devices, although the agencies said that the
malware could be repurposed to strike other architectures and
firmware.

Even more concerningly, the botnet malware is deployed as a fake
update and is capable of surviving reboots and firmware upgrades,
with command-and-control (C2) communications facilitated over the
Tor anonymity network.

“The malware itself is sophisticated and modular with basic core
functionality to beacon device information back to a server and
enable files to be downloaded and executed,” the researchers noted.
“There is also functionality to add new modules while the malware
is running, which allows Sandworm to implement additional
capability as required.”

WatchGuard, in an independent bulletin^[11], called it a
state-sponsored botnet that leveraged a previously identified
security vulnerability in the Firebox firmware as the initial
access vector. The shortcoming was eventually addressed as of May
2021.

“Based on current estimates, Cyclops Blink may have affected
approximately 1% of active WatchGuard firewall appliances,” the
company said. “Only those appliances that had been configured to
have management open to the Internet are vulnerable to Cyclops
Blink.”

The Seattle-headquartered firm is also recommending customers to
immediately follow the steps outlined in the 4-Step Cyclops Blink
Diagnosis and Remediation Plan^[12] to diagnose and
eliminate the threat posed by potential malicious activity from the
botnet.

The findings come as Russia formally launched^[13] a full scale military
operation to invade Ukraine, just as its IT infrastructure was
crippled by a string of data wiper and distributed
denial-of-service (DDoS) attacks.