Loading threat actor…
Cyclops Blink is a modular botnet malware framework associated with Russian state-linked activity and publicly tied to Sandworm, a threat group attributed to Russia’s Main Intelligence Directorate (GRU). It is designed to compromise network devices and build resilient botnet infrastructure for follow-on operations. Cyclops Blink has been discussed alongside other advanced persistent threat activity affecting Ukraine and is notable as a successor in the same general ecosystem of large-scale network-device botnets exemplified by VPNFilter. Its tradecraft centers on compromising edge and embedded devices to establish persistence and maintain command-and-control across distributed infrastructure, enabling post-compromise use of infected devices for broader operational objectives. High-confidence reporting in the supplied material supports its role as a botnet used by an advanced threat actor, but does not directly establish specific victim sectors, country targeting beyond Ukraine-related context, or ransomware/extortion activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as an example of a botnet built from compromised edge/IoT devices; mentioned to emphasize risk of initial-access vulnerabilities in such devices.
Discussed as one of the actors involved in attacks against Ukraine.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.