CyclopsBlink
Intelligence Profile
According to CISA, Cyclops Blink appears to be a replacement framework for the VPNFilter malware exposed in 2018, and which exploited network devices, primarily small office/home office (SOHO) routers and network attached storage (NAS) devices. Cyclops Blink has been deployed since at least June 2019, fourteen months after VPNFilter was disrupted. In common with VPNFilter, Cyclops Blink deployment also appears indiscriminate and widespread. The actor has so far primarily deployed Cyclops Blink to WatchGuard and ASUS devices, but it is likely that Sandworm would be capable of compiling the malware for other architectures and firmware.
Threat Analysis
CyclopsBlink is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.
Known Campaigns
Cyclops Blink is conducting an active ransomware campaign targeting organizations across 1 country. Primary targets: Healthcare, Technology. 4 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 30 Mar 2026).