CISA Warns of New Malware Framework Used by Russian ‘Sandworm’ Hacking Team

The notorious Sandworm, aka Voodoo Bear, hacking crew tied to the Russian Normal Workers Fundamental Intelligence Directorate’s Russian (GRU’s) Fundamental Centre for Particular Applied sciences (GTsST) has modified up its malware infrastructure, in accordance with an advisory issued in the present day from the UK Nationwide Cyber Safety Centre (NCSC), the Cybersecurity and Infrastructure Safety Company (CISA), the Nationwide Safety Company (NSA), and the FBI. 

Sandworm has an enormous resume of harmful assaults: the BlackEnergy assault on Ukraine’s energy techniques in 2015, the Industroyer assault in opposition to Ukraine in 2016, the NotPetya harmful data-wiping assaults in 2017, distribution denial-of-service assaults in opposition to the nation of Georgia in 2019, and disruptive assaults in opposition to the Winter Olympics and Paralympics in 2018.

The so-called Cyclops Blink modular malware framework has been in motion by Sandworm since not less than June 2019, in accordance with the companies. Cyclops Blink is often injected by way of a malicious firmware replace as soon as the sufferer’s community has been infiltrated. The malware replaces the group’s VPNFilter infrastructure, which was disrupted by the Justice Division in Could 2018. 

“The actor has to this point primarily deployed Cyclops Blink to WatchGuard units, however it’s probably that Sandworm could be able to compiling the malware for different architectures and firmware,” the advisory says, noting that solely Watchguard units that had been reset to open remote-management interfaces will be contaminated with the malware.

The total report, ready by the NCSC, supplies particulars on the Cyclops Blink malware and indicators of compromise.