Cyclops Blink botnet attacks Asus routers

Asus reports on the activity of the Cyclops Blink botnet, which is associated with the Russian-speaking hack group Sandworm. The botnet attacks Asus routers and it is believed that this malware has replaced the outdated VPNFilter.

The US and UK governments warned about the Cyclops Blink malware back in February 2022. Active since 2019, the malware that has been used to hack home and office network devices is linked by experts to the Russian hack group Sandworm (aka Telebots, BlackEnergy, Voodoo Bear).

The main application of Cyclops Blink is gaining a foothold on a device, providing hackers with an access point to compromised networks. Since the malware is modular, it can be easily adapted to work with new devices, constantly changing the pools of equipment that can be exploited.

Earlier, Trend Micro analysts wrote that Cyclops Blink has a special module designed for several models of Asus routers. It allows malware to read flash memory to collect information about important and executable files, data, and libraries. 然之後, the malware receives a command to infiltrate the memory and gain a foothold on the device, so that it was impossible to get rid of it even by resetting to factory settings.

Asus now reports that the following router models and firmware versions are vulnerable to Cyclops Blink attacks:

  1. GT-AC5300 firmware below 3.0.0.4.386.xxxx;
  2. GT-AC2900 firmware below 3.0.0.4.386.xxxx;
  3. RT-AC5300 firmware below 3.0.0.4.386.xxxx;
  4. RT-AC88U firmware below 3.0.0.4.386.xxxx;
  5. RT-AC3100 firmware below 3.0.0.4.386.xxxx;
  6. RT-AC86U firmware below 3.0.0.4.386.xxxx;
  7. RT-AC68U, AC68R, AC68W, AC68P firmware below 3.0.0.4.386.xxxx;
  8. RT-AC66U_B1 firmware below 3.0.0.4.386.xxxx;
  9. RT-AC3200 firmware below 3.0.0.4.386.xxxx;
  10. RT-AC2900 firmware below 3.0.0.4.386.xxxx;
  11. RT-AC1900P, RT-AC1900P firmware below 3.0.0.4.386.xxxx;
  12. RT-AC87U (ended);
  13. RT-AC66U (ended);
  14. PT-AC56U (ended).

So far, Asus has not released new firmware to protect against Cyclops Blink, but recommends taking the following measures to protect devices:

  1. Reset your device to factory settings.
  2. Update to the latest available firmware.
  3. Make sure the default administrator password has been changed to a more secure one.
  4. Disable remote management (disabled by default, can only be enabled in advanced settings).
If the talk is about one of the three models, support of which has already been discontinued, in this case it is recommended to simply replace the device with a newer one.

Let me remind you that we reported that FritzFrog botnet is active again, as well as that New BotenaGo Botnet Uses 33 Exploits against IoT Devices.

黑尔加·史密斯

我一直對電腦科學感興趣, 尤其是數據安全和主題, 而家被稱為 "數據科學", 由我十幾歲開始. 在進入病毒清除團隊擔任主編之前, 我曾喺多傢公司擔任網絡安全專家, 包括亞馬遜嘅承包商之一. 另一種體驗: 我在雅頓大學同雷丁大學任教.

留言

本網站使用Akismet嚟減垃圾郵件. 瞭解如何處理評論數據.

“返回頂部”按鈕