Site icon Secplicity – Security Simplified

Sharing Cyclops Blink Threat Intelligence with the Community

Corey Nachreiner

At WatchGuard, we understand the importance of sharing threat intelligence with the information security (infosec) community when safe and appropriate. Not only does this information sharing help to directly defend against known threats, but it also helps the community at large learn from the attacks found in the wild, and appropriately adjust detection and defense strategies. With that in mind, we are sharing some additional indicators of compromise (IoCs) that WatchGuard has identified related to the Cyclops Blink (CB) botnet, which was disclosed by a joint government advisory on Feb. 23, 2022 and has been found to have affected devices from multiple organizations.

The UK GCHQ’s National Cyber Security Centre (NCSC) released an informative technical malware analysis of Cyclops Blink that covers one of the PowerPC samples, and addresses the basic, default malware and shares partial IoCs. The WatchGuard team has discovered other samples and additional add-on modules for the malware. In time, WatchGuard’s Threat Lab intends to release our technical analysis report, which will include additional research information. Until then, below are additional Cyclops Blink sample IOCs, which we have also submitted to common industry threat intelligence sharing sites like Virus Total. We hope this information helps the community further detect and prevent this threat, as well as learn from it. If you’d like additional information from WatchGuard about Cyclops Blink, please check our Corporate Blog.

Cyclops Blink Indicators of Compromise:

Cyclops Blink related hashes (SHA 256)

Cyclops Blink IP Addresses

 

Exit mobile version