Cyclops Blink turned forgotten firewalls into someone else’s infrastructure

The week

On April 6, 2022, the Justice Department announced a court-authorized operation, carried out in March, to disrupt a botnet known as Cyclops Blink. The department said Sandworm, a group it attributed to Russia’s military intelligence service, controlled the botnet. It was made up of thousands of infected network devices worldwide, mostly WatchGuard firewall appliances, with some ASUS routers also targeted. The operation copied and removed the malware from devices in the United States that served as command and control nodes and closed the external management ports the actors had used. On February 23, US and UK agencies had published a joint advisory describing Cyclops Blink as a successor to VPNFilter, an earlier Sandworm botnet. WatchGuard and ASUS had issued detection and remediation guidance.

State-sponsored attacks on government are usually pictured as intrusions to steal information or cause disruption. Cyclops Blink illustrated another role. The infected firewalls and routers were not mainly targets. They were infrastructure: a distributed network of machines the operators could use to relay commands, hide their origin and stage operations elsewhere. Their owners, including small offices and local governments, might never notice. That reverses the usual risk calculation. A small agency may judge that it holds little worth stealing and spend accordingly. Its internet-facing device can still serve a foreign intelligence service against someone else. We look at three parts: why edge devices attract state actors, why they go unmanaged, and what the court-authorized operation did and did not do.

Why edge devices attract state actors

Firewalls, routers and VPN appliances sit between an organization’s network and the internet. They are always on, have public addresses and often have spare processing capacity. They run specialized operating systems that do not support the endpoint detection tools used on laptops and servers, so compromise can persist for months unseen. Their logs, if kept at all, are rarely reviewed.

For a state actor, that makes them useful in two ways. They can be footholds into the owner’s network. They can also be relays for operations against other targets, making traffic appear to come from ordinary organizations in many countries. Defenders who block a known hostile address gain little when the next hop is a county water authority’s firewall. Cyclops Blink appears to have been built mainly for the second purpose, giving its operators a resilient, global network that survived the loss of individual nodes.

Relays also complicate attribution and response. An agency whose device is used this way may first hear of it from law enforcement or a foreign partner. It may then face questions about traffic it never sent, from victims it has never heard of.

Why they go unmanaged

Many public bodies, especially small local governments, special districts, libraries and field offices, run edge devices installed once and rarely revisited. A firewall installed by a contractor years ago may still run its original firmware. Its management interface may be reachable from the internet because that was convenient during setup. Nobody may be assigned to review its alerts or read the maker’s advisories.

The February advisory explained that Cyclops Blink had been deployed on devices whose management interface was exposed to the internet, a configuration that is common and avoidable. It is the kind of detail that falls between teams. Networking owns the device, security owns monitoring, and a vendor or managed service provider may have done the installation and kept the credentials. Asset inventories often list the device by model but not its firmware version, support status, management exposure or the person responsible for it.

Budget cycles add to the drift. Firewalls are bought as capital items and expected to last for years. Support subscriptions that deliver firmware updates are operating costs that can lapse quietly. A device with an expired subscription may stop receiving fixes without anyone deciding that it should.

The fix is plain and inexpensive next to most security spending. Record every edge device, including those at remote sites and those installed by contractors, with firmware version, support status, management exposure and a named owner. Remove internet access to management interfaces unless there is a documented need and a compensating control, such as access only from a management network or a jump host. Set a deadline, measured in days, for acting on maker advisories. Replace devices whose makers no longer support them, because they will not receive the fix for the next flaw.

What the operation did and did not do

The operation was notable because the government, with court authorization, acted directly on devices it did not own. It removed malware and closed the access path on the command nodes without waiting for owners. The department described the steps as limited and said it did not access other content on the devices. It followed a 2021 operation that removed web shells from compromised Microsoft Exchange servers, and it signaled that such operations would recur.

The operation also showed the limits of that approach. The device makers had published remediation tools weeks earlier, and many infected devices had not been cleaned. The government action disrupted the command layer. It did not patch, reconfigure or replace devices, and it did not stop the next campaign from using them. Owners still had to remediate, update firmware and fix configurations.

For agencies, that sets a clear expectation. A government advisory naming a device type is an instruction to check the agency’s own estate that day. Under service contracts, the obligation to act on such advisories, with a deadline, belongs with the provider that manages the device. Agencies that rely on managed providers should require monthly reports of device firmware levels and management exposure, not only availability statistics.

With hindsight

Cyclops Blink was an early example of a pattern that intensified. In June 2023, CISA issued Binding Operational Directive 23-02, requiring federal agencies to remove internet exposure of management interfaces on network devices. In January 2024, the Justice Department announced another court-authorized operation, against a botnet of end-of-life small office routers that a Chinese state-sponsored group had used to hide activity aimed at US critical infrastructure. In September 2024 it disrupted a further botnet of hundreds of thousands of internet-connected devices linked to a Chinese company. Exploitation of VPN appliances and firewalls from several major vendors became one of the most common routes into organizations, often before fixes existed. By this point in 2026, edge device inventory, management exposure and end-of-life replacement are core expectations in public sector security frameworks. The devices installed and then forgotten remain the problem.