Cyclops Blink botnet attacks Asus routers

Asus reports on the activity of the Cyclops Blink botnet, which is associated with the Russian-speaking hack group Sandworm. The botnet attacks Asus routers and it is believed that this malware has replaced the outdated VPNFilter.

The US and UK governments warned about the Cyclops Blink malware back in February 2022. Active since 2019, the malware that has been used to hack home and office network devices is linked by experts to the Russian hack group Sandworm (aka Telebots, BlackEnergy, Voodoo Bear).

The main application of Cyclops Blink is gaining a foothold on a device, providing hackers with an access point to compromised networks. Since the malware is modular, it can be easily adapted to work with new devices, constantly changing the pools of equipment that can be exploited.

Earlier, Trend Micro analysts wrote that Cyclops Blink has a special module designed for several models of Asus routers. It allows malware to read flash memory to collect information about important and executable files, data, and libraries. After that, the malware receives a command to infiltrate the memory and gain a foothold on the device, so that it was impossible to get rid of it even by resetting to factory settings.

Asus now reports that the following router models and firmware versions are vulnerable to Cyclops Blink attacks:

  1. GT-AC5300 firmware below 3.0.0.4.386.xxxx;
  2. GT-AC2900 firmware below 3.0.0.4.386.xxxx;
  3. RT-AC5300 firmware below 3.0.0.4.386.xxxx;
  4. RT-AC88U firmware below 3.0.0.4.386.xxxx;
  5. RT-AC3100 firmware below 3.0.0.4.386.xxxx;
  6. RT-AC86U firmware below 3.0.0.4.386.xxxx;
  7. RT-AC68U, AC68R, AC68W, AC68P firmware below 3.0.0.4.386.xxxx;
  8. RT-AC66U_B1 firmware below 3.0.0.4.386.xxxx;
  9. RT-AC3200 firmware below 3.0.0.4.386.xxxx;
  10. RT-AC2900 firmware below 3.0.0.4.386.xxxx;
  11. RT-AC1900P, RT-AC1900P firmware below 3.0.0.4.386.xxxx;
  12. RT-AC87U (ended);
  13. RT-AC66U (ended);
  14. PT-AC56U (ended).

So far, Asus has not released new firmware to protect against Cyclops Blink, but recommends taking the following measures to protect devices:

  1. Reset your device to factory settings.
  2. Update to the latest available firmware.
  3. Make sure the default administrator password has been changed to a more secure one.
  4. Disable remote management (disabled by default, can only be enabled in advanced settings).
If the talk is about one of the three models, support of which has already been discontinued, in this case it is recommended to simply replace the device with a newer one.

Let me remind you that we reported that FritzFrog botnet is active again, as well as that New BotenaGo Botnet Uses 33 Exploits against IoT Devices.

हेल्गा स्मिथ

मुझे हमेशा से कंप्यूटर विज्ञान में रुचि थी, विशेष रूप से डेटा सुरक्षा और विषय, जिसे आजकल कहा जाता है "डेटा विज्ञान", मेरी शुरुआती किशोरावस्था से ही. मुख्य संपादक के रूप में वायरस रिमूवल टीम में आने से पहले, मैंने कई कंपनियों में साइबर सुरक्षा विशेषज्ञ के रूप में काम किया, जिसमें अमेज़न का एक ठेकेदार भी शामिल है. एक और अनुभव: मुझे आर्डेन और रीडिंग विश्वविद्यालयों में पढ़ाना है.

उत्तर छोड़ दें

यह साइट स्पैम को कम करने के लिए Akismet का उपयोग करती है. जानें कि आपका टिप्पणी डेटा कैसे संसाधित किया जाता है.

शीर्ष पर वापस जाएँ बटन