Cyclops Blink

Malware
6 incidents First seen 2026-04-09 Last seen 2026-10-22
Overview

Cyclops Blink is a modular malware that has been used in widespread campaigns by Sandworm Team since at least 2019 to target Small/Home Office (SOHO) network devices, including WatchGuard and Asus. Cyclops Blink is assessed to be a replacement for VPNFilter, a similar platform targeting network devices.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170 23 techniques 1 groups use it Network Devices in ATT&CK since 2022-03-03 updated 2026-05-12 · v1.2
Activity by month (incidents)
2026-042026-10
Sectors targeted
government · 5manufacturing · 2technology · 2cryptocurrency · 1energy · 1finance · 1logistics · 1retail · 1
Countries targeted
US · 4GB · 2AR · 1AU · 1AW · 1BO · 1BR · 1CA · 1CL · 1CN · 1CO · 1CR · 1
Origin
RU · 5AU · 1CA · 1CN · 1CY · 1GB · 1
Kinds of incident
Exploited Vulnerability · 5Malware & Botnets · 2Cyberattack (general) · 1State-Sponsored & Espionage · 1
Techniques seen in incidents
Botnet · 4Reconnaissance · 4T1588.006 - Vulnerabilities · 4Espionage · 3Exfiltration · 3Privilege Escalation · 3Ransomware · 3T1588.001 - Malware · 3Ddos · 2Lateral Movement · 2T1059.006 - Python · 2T1589.001 - Credentials · 2T1592.002 - Software · 2Data Breach · 1
Related actors
APT28 · 1Star Blizzard · 1
Related CVEs
CVE-2026-20079 · 3CVE-2026-20316 · 3CVE-2026-83548 · 2CVE-2026-83549 · 2CVE-2021-22175 · 1CVE-2021-35394 · 1CVE-2021-39935 · 1CVE-2025-68700 · 1CVE-2025-69286 · 1CVE-2026-102764 · 1
ATT&CK techniques by tactic (23)
execution T1106 Native API T1559 Inter-Process Communication
persistence T1037.004 RC Scripts T1542.002 Component Firmware
privilege escalation T1037.004 RC Scripts
discovery T1016 System Network Configuration Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery
collection T1005 Data from Local System
command and control T1071.001 Web Protocols T1090.003 Multi-hop Proxy T1105 Ingress Tool Transfer T1132.002 Non-Standard Encoding T1571 Non-Standard Port T1572 Protocol Tunneling T1573.002 Asymmetric Cryptography
exfiltration T1041 Exfiltration Over C2 Channel
stealth T1036.005 Match Legitimate Resource Name or Location T1070.006 Timestomp T1140 Deobfuscate/Decode Files or Information T1542.002 Component Firmware
defense impairment T1686.002 Network Device Firewall
Groups that use it
Sandworm Team
Incident timeline
2026-10-22
Talos Intelligence HackRead AlienVault OTX SecurityWeek Dark Reading AlienVault OTX BleepingComputer The Hacker News AlienVault OTX AlienVault OTX AlienVault OTX AlienVault OTX
2026-09-17
Security Affairs BleepingComputer The Hacker News BleepingComputer
2026-09-14
Dark Reading CyberScoop BleepingComputer
2026-09-10
Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware
AlienVault OTX AlienVault OTX Sophos News
2026-09-09
The Hacker News The Hacker News BleepingComputer AlienVault OTX
2026-04-09
HackRead Infosecurity-Magazine CyberScoop