ATT&CK ReferencesTrend Micro Cyclops Blink March 2022

Trend Micro Cyclops Blink March 2022

Haquebord, F. et al. (2022, March 17). Cyclops Blink Sets Sights on Asus Routers. Retrieved March 17, 2022.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1016 System Network Configuration Discovery	MalwareCyclops Blink	Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names. NCSC Cyclops Blink February 2022 Trend Micro Cyclops Blink March 2022
T1071.001 Web Protocols	MalwareCyclops Blink	Cyclops Blink can download files via HTTP and HTTPS. NCSC Cyclops Blink February 2022 Trend Micro Cyclops Blink March 2022
T1083 File and Directory Discovery	MalwareCyclops Blink	Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory. NCSC Cyclops Blink February 2022 Trend Micro Cyclops Blink March 2022
T1105 Ingress Tool Transfer	MalwareCyclops Blink	Cyclops Blink has the ability to download files to target systems. NCSC Cyclops Blink February 2022 Trend Micro Cyclops Blink March 2022
T1559 Inter-Process Communication	MalwareCyclops Blink	Cyclops Blink has the ability to create a pipe to enable inter-process communication. Trend Micro Cyclops Blink March 2022
T1572 Protocol Tunneling	MalwareCyclops Blink	Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes. Trend Micro Cyclops Blink March 2022
T1686.002 Network Device Firewall	MalwareCyclops Blink	Cyclops Blink can modify the Linux iptables firewall to enable C2 communication on network devices via a stored list of port numbers. NCSC Cyclops Blink February 2022 Trend Micro Cyclops Blink March 2022

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.