mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
27 lines
1.5 KiB
YAML
27 lines
1.5 KiB
YAML
name: CyclopsBLink
|
|
id: 7c75b1c8-dfff-46f1-8250-e58df91b6fd9
|
|
version: 1
|
|
date: '2022-04-07'
|
|
author: Teoderick Contreras, Splunk
|
|
description: Leverage searches that allow you to detect and investigate unusual activities
|
|
that might relate to the cyclopsblink malware including firewall modification, spawning more process, botnet c2 communication, defense evasion and etc.
|
|
Cyclops Blink is a Linux ELF executable compiled for 32-bit x86 and PowerPC architecture that has targeted several network devices.
|
|
The complete list of targeted devices is unknown at this time, but WatchGuard FireBox has specifically been listed as a target.
|
|
The modular malware consists of core components and modules that are deployed as child processes using the Linux API fork.
|
|
At this point, four modules have been identified that download and upload files, gather system information and contain updating mechanisms for the malware itself.
|
|
Additional modules can be downloaded and executed from the Command And Control (C2) server.
|
|
narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption
|
|
is the goal.
|
|
references:
|
|
- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
|
|
- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
|
|
tags:
|
|
analytic_story: Cyclops BLink
|
|
category:
|
|
- Malware
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|