On Wednesday Attorney General Merrick Garland and FBI Director, Christopher Wray announced that the FBI had disrupted a Cyclops Blink botnet attack by Russia.

AG Garland revealed that cybersecurity specialists were able to target the botnet which hit thousands of infected devices. The initial malware attack is being blamed on Sandworm; a Russian Military Intelligence linked hacking operation.

The NSA and CISA issued advisories and guidance on the malicious software in February. It targets vulnerable routers and firewall devices primarily from PC maker Asus and WatchGuard, the network security provider.  

Cyclops Blink new botnet

The malware infection was identified on February 23rd through a search warrant. And the FBI notified owners of infected devices in the US. It also notified companies outside the country through local law enforcement partners. 

Russia’s attempt to hijack the computers with Cyclops Blink botnets was most likely the precursor to a large-scale Distributed Denial of Service (DDoS) attack. A massive DDoS attack hit Ukraine a week before Russia invaded. 

When activated the Cyclops Blink botnets could have overwhelmed any system it connected. In a DDoS attack, the computer is hit with a massive spam campaign which opens the door to compromise of sensitive information. 

The Justice Department and the FBI obtained warrants which allowed them to find and remotely remove the malware from infected devices.

After the feds removed the malware on compromised devices, they closed the external management ports Sandworm was using for access.

“This court-authorized removal of malware deployed by the Russian GRU demonstrates the department’s commitment to disrupt nation-state hacking using all of the legal tools at our disposal,” said Assistant Attorney General Matthew Olsen. 

Justice officials worked with cybersecurity specialists in the FBI and government agencies in the United Kingdom. They also worked with Watchguard to eliminate the malware threat and mitigate the possibilities in the future.

“This operation is an example of the FBI’s commitment to combating cyber threats through our unique authorities, capabilities, and coordination with our partners,” said Bryan Vorndran, the assistant director of the FBI’s Cyber Division.

 “As the lead domestic law enforcement and intelligence agency, we will continue pursuing cyber actors that threaten the national security and public safety of the American people, our private sector partners, and our international partners,” he added.