Cyclops Blink
Software · ATTACK:enterprise:S0687
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0687",
"title": "Cyclops Blink",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0687",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--b350b47f-88fe-4921-8538-6d9c59bac84e",
"external_id": "S0687",
"domain": "enterprise",
"created": "2022-03-03T15:37:41.440Z",
"modified": "2026-05-12T15:12:00.739Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Trend Micro Cyclops Blink March 2022",
"url": "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html"
},
{
"source_name": "NCSC CISA Cyclops Blink Advisory February 2022",
"url": "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
},
{
"source_name": "NCSC Cyclops Blink February 2022",
"url": "https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0229d70b-03ef-4744-aa06-348dd4bcbd10
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0766fe91-a8d9-42bd-8023-f2134b280211
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10b32db9-57a8-4baa-b540-3d26f9c7137b
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ad60707-d84f-4768-9013-6b499de49c40
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--350776c3-9234-4c8f-adff-9b36778e90c4
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1542.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b2668bf-31ee-4bee-a624-ab526124623b
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5403aad2-3840-4b49-8124-961e1a24d044
NCSC Cyclops Blink February 2022ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0687
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6409dbdd-d253-4b4a-8740-8b9592c75f25
NCSC CISA Cyclops Blink Advisory February 2022 · Trend Micro Cyclops Blink March 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--650fddda-8aa5-4311-9772-ba8ab0ed4afa
NCSC Cyclops Blink February 2022 · Trend Micro Cyclops Blink March 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fb33043-4b78-407d-a452-d242349d6c0d
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b3cb69c-7b85-4d52-8cab-867ea1126fc7
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8bb3348e-f844-4e02-8f15-3e509478f120
NCSC Cyclops Blink February 2022 · Trend Micro Cyclops Blink March 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97da1ec3-e4cd-451e-83be-d53adabb78ed
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa498c95-d53a-4ab7-96ba-26d7111d71d0
NCSC CISA Cyclops Blink Advisory February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1559
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aba4b49c-0e87-4e81-81ce-cdefff278c5f
Trend Micro Cyclops Blink March 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1686.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c329aee6-3e4d-42c1-baef-bdb011d6f90c
Trend Micro Cyclops Blink March 2022 · NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca7d9090-d5ff-4a10-b403-015daa559e84
Trend Micro Cyclops Blink March 2022 · NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e597058d-ca4b-48e8-b924-8f1e8db34dc0
NCSC Cyclops Blink February 2022 · Trend Micro Cyclops Blink March 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8a13c1f-d4b9-495d-b039-112c4d60916b
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e98ae201-7492-4aef-9b17-6499956bbe2b
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3b71f03-f6d5-4ae2-a8e8-a6263550e5a5
Trend Micro Cyclops Blink March 2022ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4a65903-0b28-4e52-ad3b-bb7c55772509
NCSC Cyclops Blink February 2022