Cyclops-Blink-Malware-Analysis-Report.pdf

## Executive summary Cyclops Blink is a sophisticated, modular Linux ELF malware targeting SOHO network devices (notably WatchGuard Firebox) that achieves persistent infection by modifying the firmware update process (including recalculating firmware HMAC), implements modular reconnaissance, file transfer and update components, and communicates with encrypted C2 channels (AES-256-CBC under TLS) using hard-coded RSA keys; the report includes sample metadata, IOCs (paths, hashes, C2 IPs), MITRE ATT&CK mappings and YARA detection rules.