Cyclops Blink botnet attacks Asus routers

Asus reports on the activity of the Cyclops Blink botnet, which is associated with the Russian-speaking hack group Sandworm. The botnet attacks Asus routers and it is believed that this malware has replaced the outdated VPNFilter.

The US and UK governments warned about the Cyclops Blink malware back in February 2022. Active since 2019, the malware that has been used to hack home and office network devices is linked by experts to the Russian hack group Sandworm (aka Telebots, BlackEnergy, Voodoo Bear).

The main application of Cyclops Blink is gaining a foothold on a device, providing hackers with an access point to compromised networks. Since the malware is modular, it can be easily adapted to work with new devices, constantly changing the pools of equipment that can be exploited.

Earlier, Trend Micro analysts wrote that Cyclops Blink has a special module designed for several models of Asus routers. It allows malware to read flash memory to collect information about important and executable files, data, and libraries. After that, the malware receives a command to infiltrate the memory and gain a foothold on the device, so that it was impossible to get rid of it even by resetting to factory settings.

Asus now reports that the following router models and firmware versions are vulnerable to Cyclops Blink attacks:

  1. GT-AC5300 firmware below 3.0.0.4.386.xxxx;
  2. GT-AC2900 firmware below 3.0.0.4.386.xxxx;
  3. RT-AC5300 firmware below 3.0.0.4.386.xxxx;
  4. RT-AC88U firmware below 3.0.0.4.386.xxxx;
  5. RT-AC3100 firmware below 3.0.0.4.386.xxxx;
  6. RT-AC86U firmware below 3.0.0.4.386.xxxx;
  7. RT-AC68U, AC68R, AC68W, AC68P firmware below 3.0.0.4.386.xxxx;
  8. RT-AC66U_B1 firmware below 3.0.0.4.386.xxxx;
  9. RT-AC3200 firmware below 3.0.0.4.386.xxxx;
  10. RT-AC2900 firmware below 3.0.0.4.386.xxxx;
  11. RT-AC1900P, RT-AC1900P firmware below 3.0.0.4.386.xxxx;
  12. RT-AC87U (ended);
  13. RT-AC66U (ended);
  14. PT-AC56U (ended).

So far, Asus has not released new firmware to protect against Cyclops Blink, but recommends taking the following measures to protect devices:

  1. Reset your device to factory settings.
  2. Update to the latest available firmware.
  3. Make sure the default administrator password has been changed to a more secure one.
  4. Disable remote management (disabled by default, can only be enabled in advanced settings).
If the talk is about one of the three models, support of which has already been discontinued, in this case it is recommended to simply replace the device with a newer one.

Let me remind you that we reported that FritzFrog botnet is active again, as well as that New BotenaGo Botnet Uses 33 Exploits against IoT Devices.

Helga Smith

Saya sentiasa berminat dalam sains komputer, terutamanya keselamatan data dan tema, yang dipanggil pada masa kini "sains data", sejak awal remaja saya. Sebelum menyertai pasukan Pembuangan Virus sebagai ketua Editor, Saya bekerja sebagai pakar keselamatan siber di beberapa syarikat, termasuk salah seorang kontraktor Amazon. Satu lagi pengalaman: Saya ada mengajar di universiti Arden dan Reading.

Tinggalkan pesanan

Laman web ini menggunakan Akismet untuk mengurangkan spam. Ketahui cara data ulasan anda diproses.

Butang kembali ke atas