Cyclops Blink botnet attacks Asus routers

Asus reports on the activity of the Cyclops Blink botnet, which is associated with the Russian-speaking hack group Sandworm. The botnet attacks Asus routers and it is believed that this malware has replaced the outdated VPNFilter.

The US and UK governments warned about the Cyclops Blink malware back in February 2022. Active since 2019, the malware that has been used to hack home and office network devices is linked by experts to the Russian hack group Sandworm (aka Telebots, BlackEnergy, Voodoo Bear).

The main application of Cyclops Blink is gaining a foothold on a device, providing hackers with an access point to compromised networks. Since the malware is modular, it can be easily adapted to work with new devices, constantly changing the pools of equipment that can be exploited.

Earlier, Trend Micro analysts wrote that Cyclops Blink has a special module designed for several models of Asus routers. It allows malware to read flash memory to collect information about important and executable files, data, and libraries. After that, the malware receives a command to infiltrate the memory and gain a foothold on the device, so that it was impossible to get rid of it even by resetting to factory settings.

Asus now reports that the following router models and firmware versions are vulnerable to Cyclops Blink attacks:

1. GT-AC5300 firmware below 3.0.0.4.386.xxxx;
2. GT-AC2900 firmware below 3.0.0.4.386.xxxx;
3. RT-AC5300 firmware below 3.0.0.4.386.xxxx;
4. RT-AC88U firmware below 3.0.0.4.386.xxxx;
5. RT-AC3100 firmware below 3.0.0.4.386.xxxx;
6. RT-AC86U firmware below 3.0.0.4.386.xxxx;
7. RT-AC68U, AC68R, AC68W, AC68P firmware below 3.0.0.4.386.xxxx;
8. RT-AC66U_B1 firmware below 3.0.0.4.386.xxxx;
9. RT-AC3200 firmware below 3.0.0.4.386.xxxx;
10. RT-AC2900 firmware below 3.0.0.4.386.xxxx;
11. RT-AC1900P, RT-AC1900P firmware below 3.0.0.4.386.xxxx;
12. RT-AC87U (ended);
13. RT-AC66U (ended);
14. PT-AC56U (ended).

So far, Asus has not released new firmware to protect against Cyclops Blink, but recommends taking the following measures to protect devices:

1. Reset your device to factory settings.
2. Update to the latest available firmware.
3. Make sure the default administrator password has been changed to a more secure one.
4. Disable remote management (disabled by default, can only be enabled in advanced settings).

Let me remind you that we reported that FritzFrog botnet is active again, as well as that New BotenaGo Botnet Uses 33 Exploits against IoT Devices.