Threat intelligence / Malware

Cyclops Blink

[Cyclops Blink](https://attack.mitre.org/software/S0687) is a modular malware that has been used in widespread campaigns by [Sandworm Team](https://attack.mitre.org/groups/G0034) since at least 2019 to target Small/Home Office (SOHO) network devices, including WatchGuard and Asus. [Cyclops Blink](https://attack.mitre.org/software/S0687) is assessed to be a replacement for [VPNFilter](https://attack.mitre.org/software/S1010), a similar platform targeting network devices.(Citation: NCSC Cyclops Blink February 2022)(Citation: NCSC CISA Cyclops Blink Advisory February 2022)(Citation: Trend Micro Cyclops Blink March 2022)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Cyclops Blink](https://attack.mitre.org/software/S0687) is a modular malware that has been used in widespread campaigns by [Sandworm Team](https://attack.mitre.org/groups/G0034) since at least 2019 to target Small/Home Office (SOHO) network devices, including WatchGuard and Asus. [Cyclops Blink](https://attack.mitre.org/software/S0687) is assessed to be a replacement for [VPNFilter](https://attack.mitre.org/software/S1010), a similar platform targeting network devices.(Citation: NCSC Cyclops Blink February 2022)(Citation: NCSC CISA Cyclops Blink Advisory February 2022)(Citation: Trend Micro Cyclops Blink March 2022)

Labels

malware

22 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Component Firmware

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inter-Process Communication

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Multi-hop Proxy

Technique

uses

Technique

uses

to Network Device Firewall

Technique

uses

to Non-Standard Encoding

Technique

uses

to Non-Standard Port

Technique

uses

to Process Discovery

Technique

uses

to Protocol Tunneling

Technique

uses

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

uses

from Sandworm Team

Group

4 external

References

mitre-attack

S0687

Trend Micro Cyclops Blink March 2022

https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html

NCSC CISA Cyclops Blink Advisory February 2022

https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter

NCSC Cyclops Blink February 2022

https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf