APT / THREAT GROUP
Cyclops
7
victims
2
aliases
Last seen:Mar 17, 2026
Intelligence Profile
According to HarfangLabs, Cyclops is a malware platform written in Go which dates back to December 2023, and that they believe has been deployed against targets in the Middle-East in 2024. Cyclops allows operators to execute arbitrary commands on the target’s file system, as well as pivot inside the infected network. Notably, Cyclops is controlled through a HTTP REST API which is exposed to operators within an SSH tunnel.
Threat Analysis
Cyclops is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.
Ransomware Victims (7)
CTIWATCH tracks 7 organizations claimed as victims by Cyclops on its data leak site, with attack dates, sectors and countries.
View full victims list →External References
Quick Facts
TypeAPT / Threat Group
Aliases2
Also Known As
Cyclopswin.cyclops
External Intelligence
Malpedia: win.cyclopsResearch Links
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.