NCSC Cyclops Blink February 2022

Cyclops Blink can upload files from a compromised host.

Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names.

Cyclops Blink can rename its running process to [kworker:0/1] to masquerade as a Linux kernel thread. Cyclops Blink has also named RC scripts used for persistence after WatchGuard artifacts.

Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.

Cyclops Blink has the ability to upload exfiltrated files to a C2 server.

Cyclops Blink can enumerate the process it is currently running under.

Cyclops Blink has the ability to use the Linux API function `utime` to change the timestamps of modified firmware update images.

Cyclops Blink can download files via HTTP and HTTPS.

Cyclops Blink has the ability to query device information.

Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.

Cyclops Blink has the ability to download files to target systems.

Cyclops Blink can use various Linux API functions including those for execution and discovery.

Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.

Cyclops Blink can decrypt and parse instructions sent from C2.

Cyclops Blink has maintained persistence by patching legitimate device firmware when it is downloaded, including that of WatchGuard devices.

Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.

Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.

Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.

Cyclops Blink can modify the Linux iptables firewall to enable C2 communication on network devices via a stored list of port numbers.